CVE-2026-63136

MEDIUM

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Title source: cna

Description

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage this vulnerability to cause cluster downtime requiring manual intervention to restore service.

References (1)

Core 1

Core References

https://discuss.elastic.co/t/elasticsearch-8-19-15-9-2-9-9-3-4-security-update-esa-2026-60/388559

Scores

CVSS v3 6.5

EPSS 0.0024

EPSS Percentile 14.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-400

Status published

Products (3)

Elastic/Elasticsearch 8.0.0 - 8.19.14

Elastic/Elasticsearch 9.0.0 - 9.2.8

Elastic/Elasticsearch 9.3.0 - 9.3.3

Published Jul 21, 2026

Tracked Since Jul 22, 2026