CVE-2026-49090
published 2026-07-01CVE-2026-49090: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can…
PriorityP434medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.42%
34.4th percentile
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk request that causes sustained high CPU consumption, which can render the affected node unable to process requests.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | >= 7.0.0 < 7.17.24 | 7.17.24 |
| elastic | elasticsearch | 7.0.0 – 7.17.23 | — |
| elastic | elasticsearch | >= 8.0.0 < 8.15.0 | 8.15.0 |
| elastic | elasticsearch | 8.0.0 – 8.14.3 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130).
ghsa_unreviewed·2026-07-01
CVE-2026-49090 [MEDIUM] CWE-400 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130).
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk request that causes sustained high CPU consumption, which can render the affected node unable to process requests.
VulDB
Elastic Elasticsearch up to 7.17.23/8.14.3 Bulk resource consumption (EUVD-2026-41100)
vuldb·2026-07-01·CVSS 6.5
CVE-2026-49090 [MEDIUM] Elastic Elasticsearch up to 7.17.23/8.14.3 Bulk resource consumption (EUVD-2026-41100)
A vulnerability classified as problematic has been found in Elastic Elasticsearch up to 7.17.23/8.14.3. This affects an unknown function of the component Bulk Handler. The manipulation leads to resource consumption.
This vulnerability is uniquely identified as CVE-2026-49090. The attack can only be initiated within the local network. No exploit exists.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-01
Published