CVE-2026-94399
published 2026-09-26CVE-2026-94399: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
PriorityP432medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.42%
34.4th percentile
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | >= 8.0.0 < 8.19.22 | 8.19.22 |
| elastic | elasticsearch | 8.0.0 – 8.19.21 | — |
| elastic | elasticsearch | >= 9.0.0 < 9.4.7 | 9.4.7 |
| elastic | elasticsearch | 9.0.0 – 9.4.6 | — |
| elastic | elasticsearch | >= 9.5.0 < 9.5.4 | 9.5.4 |
| elastic | elasticsearch | 9.5.0 – 9.5.3 | — |
| rhoai | odh-feature-server-rhel9 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Elastic Elasticsearch up to 8.19.21/9.4.6/9.5.3 resource consumption
vuldb·2026-09-26·CVSS 6.5
CVE-2026-94399 [MEDIUM] Elastic Elasticsearch up to 8.19.21/9.4.6/9.5.3 resource consumption
A vulnerability labeled as problematic has been found in Elastic Elasticsearch up to 8.19.21/9.4.6/9.5.3. Impacted is an unknown function. Such manipulation leads to resource consumption.
This vulnerability is documented as CVE-2026-94399. The attack can be executed remotely. There is not any exploit available.
GHSA
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
ghsa_unreviewed·2026-09-26
CVE-2026-94399 [MEDIUM] CWE-400 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
Red Hat
elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
vendor_redhat·2026-09-26·CVSS 6.5
CVE-2026-94399 [MEDIUM] CWE-770 elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
A flaw was found in Elasticsearch. An authenticated remote attacker can exploit this vulnerability by submitting requests that trigger excessive resource allocation, leading to system exhaustion. This flaw can result in a Denial of Service (DoS), rendering the service unresponsive to legitimate users.
Statement: This vulnerability is rated as Moderate impact because an authenticated attacker with network reachability is required to induce service exhaustion, while data confidentiality and system integrity remain completely unaffected. Within Red Hat OpenShift AI, the aff
No detection rules found.
No public exploits indexed.
2026-09-26
Published