CVE-2026-63136 PUBLISHED

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Assigner: elastic
Reserved: 15.07.2026 Published: 21.07.2026 Updated: 21.07.2026

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage this vulnerability to cause cluster downtime requiring manual intervention to restore service.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 6.5

Product Status

Vendor Elastic
Product Elasticsearch
Versions Default: unaffected
  • affected from 8.0.0 to 8.19.14 (incl.)
  • affected from 9.3.0 to 9.3.3 (incl.)
  • affected from 9.0.0 to 9.2.8 (incl.)

References

Problem Types

  • CWE-400 Uncontrolled Resource Consumption CWE

Impacts

  • CAPEC-130 Excessive Allocation