CVE-2026-63136

Summary

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage this vulnerability to cause cluster downtime requiring manual intervention to restore service.

Affected Software

VendorProductVersion RangeStatus
ElasticElasticsearch8.0.0 <= 8.19.14affected
ElasticElasticsearch9.3.0 <= 9.3.3affected
ElasticElasticsearch9.0.0 <= 9.2.8affected

Weaknesses

  • CWE-400: CWE-400 Uncontrolled Resource Consumption

References