CVE-2026-56145

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL sequence queries against an index they control can send a specially crafted query that triggers excessive memory consumption, causing the Elasticsearch node to crash.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://discuss.elastic.co/t/elasticsearch-8-19-18-9-3-7-9-4-4-security-update-esa-2026-57/388556	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:elastic:elasticsearch::::::::
	cpe:2.3:a:elastic:elasticsearch::::::::
	cpe:2.3:a:elastic:elasticsearch::::::::

History

24 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) El Consumo Incontrolado de Recursos (CWE-400) en Elasticsearch puede conducir a una denegación de servicio a través de Asignación Excesiva (CAPEC-130). Un usuario autenticado con bajos privilegios y con permiso para ejecutar consultas de secuencia EQL contra un índice que controla puede enviar una consulta especialmente diseñada que desencadena un consumo excesivo de memoria, provocando que el nodo de Elasticsearch se bloquee.

Information

Published : 2026-07-21 20:17

Updated : 2026-10-24 19:10

NVD link : CVE-2026-56145

Mitre link : CVE-2026-56145

CVE.ORG link : CVE-2026-56145

JSON object : View

Products Affected

elastic

elasticsearch

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-56145", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-56145", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T18:13:57.687829Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@elastic.co", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@elastic.co", "affectedData": [{"vendor": "Elastic", "product": "Elasticsearch", "versions": [{"status": "affected", "version": "9.4.0", "versionType": "semver", "lessThanOrEqual": "9.4.3"}, {"status": "affected", "version": "8.0.0", "versionType": "semver", "lessThanOrEqual": "8.19.17"}, {"status": "affected", "version": "9.0.0", "versionType": "semver", "lessThanOrEqual": "9.3.6"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-21T20:17:02.500", "references": [{"url": "https://discuss.elastic.co/t/elasticsearch-8-19-18-9-3-7-9-4-4-security-update-esa-2026-57/388556", "tags": ["Vendor Advisory"], "source": "security@elastic.co"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@elastic.co", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL sequence queries against an index they control can send a specially crafted query that triggers excessive memory consumption, causing the Elasticsearch node to crash."}, {"lang": "es", "value": "El Consumo Incontrolado de Recursos (CWE-400) en Elasticsearch puede conducir a una denegaci\u00f3n de servicio a trav\u00e9s de Asignaci\u00f3n Excesiva (CAPEC-130). Un usuario autenticado con bajos privilegios y con permiso para ejecutar consultas de secuencia EQL contra un \u00edndice que controla puede enviar una consulta especialmente dise\u00f1ada que desencadena un consumo excesivo de memoria, provocando que el nodo de Elasticsearch se bloquee."}], "lastModified": "2026-10-24T19:10:00.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "691E83C2-9C1B-40CF-AD6B-3C036D928E8C", "versionEndExcluding": "8.19.18", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B223737-B8B8-4D19-80D2-060A06F46AC0", "versionEndExcluding": "9.3.7", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54F14824-0093-4DA8-95AD-ED8F481722FC", "versionEndExcluding": "9.4.4", "versionStartIncluding": "9.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@elastic.co"}