CVE-2026-82294
published 2026-09-26CVE-2026-82294: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
PriorityP432medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.42%
34.4th percentile
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | >= 8.0.0 < 8.19.21 | 8.19.21 |
| elastic | elasticsearch | 8.0.0 – 8.19.20 | — |
| elastic | elasticsearch | >= 9.0.0 < 9.4.6 | 9.4.6 |
| elastic | elasticsearch | 9.0.0 – 9.4.5 | — |
| elastic | elasticsearch | >= 9.5.0 < 9.5.3 | 9.5.3 |
| elastic | elasticsearch | 9.5.0 – 9.5.2 | — |
| rhoai | odh-feature-server-rhel9 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
ghsa_unreviewed·2026-09-26
CVE-2026-82294 [MEDIUM] CWE-400 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
VulDB
Elastic Elasticsearch up to 8.19.20/9.4.5/9.5.2 resource consumption
vuldb·2026-09-26·CVSS 6.5
CVE-2026-82294 [MEDIUM] Elastic Elasticsearch up to 8.19.20/9.4.5/9.5.2 resource consumption
A vulnerability was found in Elastic Elasticsearch up to 8.19.20/9.4.5/9.5.2. It has been classified as problematic. Affected by this vulnerability is an unknown functionality. Performing a manipulation results in resource consumption.
This vulnerability is identified as CVE-2026-82294. The attack can be initiated remotely. There is not any exploit available.
Red Hat
elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
vendor_redhat·2026-09-26·CVSS 6.5
CVE-2026-82294 [MEDIUM] CWE-770 elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
A flaw was found in Elasticsearch. An authenticated remote attacker can exploit this vulnerability to trigger excessive resource allocation, leading to a Denial of Service (DoS). By sending requests that consume disproportionate system resources, an attacker can exhaust system capacity and cause the service to become unresponsive.
Statement: This vulnerability is rated as Moderate because exploitation requires authenticated network access and solely results in a denial of service without compromising system confidentiality or integrity. In Red Hat environments, inclu
No detection rules found.
No public exploits indexed.
2026-09-26
Published