CVE-2026-94397
published 2026-09-26CVE-2026-94397: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
PriorityP432medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.42%
34.4th percentile
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | >= 8.0.0 < 8.19.22 | 8.19.22 |
| elastic | elasticsearch | 8.0.0 – 8.19.21 | — |
| elastic | elasticsearch | >= 9.0.0 < 9.4.7 | 9.4.7 |
| elastic | elasticsearch | 9.0.0 – 9.4.6 | — |
| elastic | elasticsearch | >= 9.5.0 < 9.5.4 | 9.5.4 |
| elastic | elasticsearch | 9.5.0 – 9.5.3 | — |
| rhoai | odh-feature-server-rhel9 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
vendor_redhat·2026-09-26·CVSS 6.5
CVE-2026-94397 [MEDIUM] CWE-770 elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
A flaw was found in Elasticsearch. An authenticated remote attacker can exploit an uncontrolled resource consumption issue by submitting requests that trigger excessive allocation of system resources. This can exhaust available capacity, resulting in a Denial of Service (DoS) where the service becomes unresponsive or crashes.
Statement: This vulnerability is rated as Moderate impact because successful exploitation requires authenticated access and exclusively produces a denial of service, with no compromise to data confidentiality or integrity. Within Red Hat environment
GHSA
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
ghsa_unreviewed·2026-09-26
CVE-2026-94397 [MEDIUM] CWE-400 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
VulDB
Elastic Elasticsearch up to 8.19.21/9.4.6/9.5.3 resource consumption
vuldb·2026-09-26·CVSS 6.5
CVE-2026-94397 [MEDIUM] Elastic Elasticsearch up to 8.19.21/9.4.6/9.5.3 resource consumption
A vulnerability categorized as problematic has been discovered in Elastic Elasticsearch up to 8.19.21/9.4.6/9.5.3. This vulnerability affects unknown code. The manipulation results in resource consumption.
This vulnerability is cataloged as CVE-2026-94397. The attack may be launched remotely. There is no exploit available.
No detection rules found.
No public exploits indexed.
2026-09-26
Published