CVE-2026-82300
published 2026-09-26CVE-2026-82300: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
PriorityP432medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.42%
34.4th percentile
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | >= 8.0.0 < 8.19.22 | 8.19.22 |
| elastic | elasticsearch | 8.0.0 – 8.19.21 | — |
| elastic | elasticsearch | >= 9.0.0 < 9.4.7 | 9.4.7 |
| elastic | elasticsearch | 9.0.0 – 9.4.6 | — |
| elastic | elasticsearch | >= 9.5.0 < 9.5.4 | 9.5.4 |
| elastic | elasticsearch | 9.5.0 – 9.5.3 | — |
| rhoai | odh-feature-server-rhel9 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
vendor_redhat·2026-09-26·CVSS 6.5
CVE-2026-82300 [MEDIUM] CWE-770 elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
A flaw was found in Elasticsearch. An authenticated remote attacker can exploit uncontrolled resource consumption to trigger excessive allocation of system resources. This issue can exhaust available memory or processing capacity, leading to a Denial of Service (DoS) where the service becomes unresponsive.
Statement: This flaw is rated as Moderate impact for Red Hat products because triggering the resource exhaustion requires authenticated access to the service and only affects availability. While a successful attack can result in a denial of service due to excessive
VulDB
Elastic Elasticsearch up to 8.19.21/9.4.7/9.5.3 resource consumption
vuldb·2026-09-26·CVSS 6.5
CVE-2026-82300 [MEDIUM] Elastic Elasticsearch up to 8.19.21/9.4.7/9.5.3 resource consumption
A vulnerability was found in Elastic Elasticsearch up to 8.19.21/9.4.7/9.5.3. It has been declared as problematic. Affected by this issue is some unknown functionality. Executing a manipulation can lead to resource consumption.
This vulnerability is tracked as CVE-2026-82300. The attack can be launched remotely. No exploit exists.
GHSA
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
ghsa_unreviewed·2026-09-26
CVE-2026-82300 [MEDIUM] CWE-400 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
No detection rules found.
No public exploits indexed.
2026-09-26
Published