CVE-2026-63136

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

State: Published
Severity: 6.5 Medium
Published: Jul 21, 2026
Updated: Jul 22, 2026
Reserved: Jul 15, 2026

Description

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage this vulnerability to cause cluster downtime requiring manual intervention to restore service.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	elastic

Weaknesses

CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
ElasticsearchElastic	8.0.0 through 8.19.14Affected 9.3.0 through 9.3.3Affected 9.0.0 through 9.2.8Affected

References

https://discuss.elastic.co/t/elasticsearch-8-19-15-9-2-9-9-3-4-security-update-esa-2026-60/388559

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.