CVE-2026-94408
published 2026-09-26CVE-2026-94408: Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
PriorityP422medium4.9CVSS 3.1
AVNACLPRHUINSUCNINAH
EPSS
0.44%
36.3th percentile
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | >= 8.0.0 < 8.19.22 | 8.19.22 |
| elastic | elasticsearch | 8.0.0 – 8.19.21 | — |
| elastic | elasticsearch | >= 9.0.0 < 9.4.7 | 9.4.7 |
| elastic | elasticsearch | 9.0.0 – 9.4.6 | — |
| elastic | elasticsearch | >= 9.5.0 < 9.5.3 | 9.5.3 |
| elastic | elasticsearch | 9.5.0 – 9.5.2 | — |
| rhoai | odh-feature-server-rhel9 | — | — |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
vendor_redhat4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
ghsa_unreviewed·2026-09-26
CVE-2026-94408 [MEDIUM] CWE-400 Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)
VulDB
Elastic Elasticsearch up to 8.19.21/9.4.6/9.5.2 resource consumption
vuldb·2026-09-26·CVSS 4.9
CVE-2026-94408 [MEDIUM] Elastic Elasticsearch up to 8.19.21/9.4.6/9.5.2 resource consumption
A vulnerability described as problematic has been identified in Elastic Elasticsearch up to 8.19.21/9.4.6/9.5.2. The impacted element is an unknown function. Executing a manipulation can lead to resource consumption.
This vulnerability appears as CVE-2026-94408. The attack may be performed from remote. There is no available exploit.
Upgrading the affected component is recommended.
Red Hat
elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
vendor_redhat·2026-09-26·CVSS 4.9
CVE-2026-94408 [MEDIUM] CWE-770 elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service
A flaw was found in Elasticsearch. An authenticated remote attacker with high privileges can cause a Denial of Service (DoS) by triggering excessive resource allocation. Successful exploitation can lead to system resource exhaustion, rendering the service unresponsive or unavailable to legitimate users.
Statement: This vulnerability is rated as Moderate impact because exploitation requires an attacker to possess high administrative privileges, substantially reducing the exposure surface in typical deployments. While a privileged user can exhaust cluster resources and render the service unavailable, the flaw does not facilitate arbitrary code execution or compromise data confidentiality and inte
No detection rules found.
No public exploits indexed.
2026-09-26
Published