CVE-2026-94408

Received Received - Intake

Uncontrolled Resource Consumption in Elasticsearch

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: Elastic

Description

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-26

Last Modified

2026-09-26

Generated

2026-09-27

AI Q&A

2026-09-27

EPSS Evaluated

N/A

NVD

CVE-2026-94408

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability involves uncontrolled resource consumption in Elasticsearch, specifically due to excessive allocation. It can lead to a denial of service condition by consuming too many system resources, making the service unavailable.

Impact Analysis

The impact includes service disruption as Elasticsearch may become unresponsive or crash due to resource exhaustion. This can affect applications relying on Elasticsearch for search or data processing, leading to downtime or degraded performance.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by causing service disruptions due to denial of service. Uncontrolled resource consumption may lead to system unavailability, which could violate availability requirements in these regulations.

Mitigation Strategies

Monitor Elasticsearch resource usage for excessive allocation patterns. Limit memory and CPU allocation in Elasticsearch configuration to prevent uncontrolled resource consumption. Apply the latest security patches from Elastic as soon as they are available.

Hi! I’m here to help you understand CVE-2026-94408. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70