CVE-2026-94398
published 2026-09-26CVE-2026-94398: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
PriorityP432medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.42%
34.4th percentile
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | >= 8.12.0 < 8.19.22 | 8.19.22 |
| elastic | elasticsearch | 8.12.0 – 8.19.21 | — |
| elastic | elasticsearch | >= 9.0.0 < 9.4.7 | 9.4.7 |
| elastic | elasticsearch | 9.0.0 – 9.4.6 | — |
| elastic | elasticsearch | >= 9.5.0 < 9.5.4 | 9.5.4 |
| elastic | elasticsearch | 9.5.0 – 9.5.3 | — |
| rhoai | odh-feature-server-rhel9 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
vendor_redhat·2026-09-26·CVSS 6.5
CVE-2026-94398 [MEDIUM] CWE-770 elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
A flaw was found in Elasticsearch. An authenticated remote attacker can exploit this vulnerability by submitting requests that trigger disproportionate memory allocation. This excessive resource consumption can lead to process termination and a Denial of Service (DoS) for the service.
Statement: Red Hat has evaluated this vulnerability as having a Moderate security impact because exploiting the flaw requires network access with valid user credentials to submit requests that trigger disproportionate memory allocation. The resulting failure is limited to availability degradation through service disruption or process termination, without compromising data confidentiality or system integrity. In Re
GHSA
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
ghsa_unreviewed·2026-09-26
CVE-2026-94398 [MEDIUM] CWE-400 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
VulDB
Elastic Elasticsearch up to 8.19.21/9.4.6/9.5.3 resource consumption
vuldb·2026-09-26·CVSS 6.5
CVE-2026-94398 [MEDIUM] Elastic Elasticsearch up to 8.19.21/9.4.6/9.5.3 resource consumption
A vulnerability identified as problematic has been detected in Elastic Elasticsearch up to 8.19.21/9.4.6/9.5.3. This issue affects some unknown processing. This manipulation causes resource consumption.
This vulnerability is registered as CVE-2026-94398. Remote exploitation of the attack is possible. No exploit is available.
No detection rules found.
No public exploits indexed.
2026-09-26
Published