CVE-2026-94396
published 2026-09-26CVE-2026-94396: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
PriorityP432medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.42%
34.4th percentile
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | >= 9.2.0 < 9.4.7 | 9.4.7 |
| elastic | elasticsearch | 9.2.0 – 9.4.6 | — |
| elastic | elasticsearch | >= 9.5.0 < 9.5.4 | 9.5.4 |
| elastic | elasticsearch | 9.5.0 – 9.5.3 | — |
| rhoai | odh-feature-server-rhel9 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Elastic Elasticsearch up to 9.4.6/9.5.3 resource consumption
vuldb·2026-09-26·CVSS 6.5
CVE-2026-94396 [MEDIUM] Elastic Elasticsearch up to 9.4.6/9.5.3 resource consumption
A vulnerability was found in Elastic Elasticsearch up to 9.4.6/9.5.3. It has been rated as problematic. This affects an unknown part. The manipulation leads to resource consumption.
This vulnerability is listed as CVE-2026-94396. The attack may be initiated remotely. There is no available exploit.
GHSA
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
ghsa_unreviewed·2026-09-26
CVE-2026-94396 [MEDIUM] CWE-400 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
Red Hat
elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
vendor_redhat·2026-09-26·CVSS 6.5
CVE-2026-94396 [MEDIUM] CWE-770 elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
A flaw was found in Elasticsearch. This vulnerability allows an authenticated remote attacker to cause a Denial of Service (DoS) by triggering excessive resource allocation. By consuming uncontrolled system resources, an attacker can degrade performance or render the service unavailable.
Statement: This vulnerability is rated as Moderate impact because an authenticated attacker with network access can trigger excessive memory consumption, causing service unavailability without compromising host confidentiality or integrity. Within Red Hat environments, such as Red Hat Op
No detection rules found.
No public exploits indexed.
2026-09-26
Published