CVE-2026-63136

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage this vulnerability to cause cluster downtime requiring manual intervention to restore service.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://discuss.elastic.co/t/elasticsearch-8-19-15-9-2-9-9-3-4-security-update-esa-2026-60/388559	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:elastic:elasticsearch::::::::
	cpe:2.3:a:elastic:elasticsearch::::::::
	cpe:2.3:a:elastic:elasticsearch::::::::

History

24 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) El Consumo de Recursos No Controlado (CWE-400) en Elasticsearch puede conducir a una denegación de servicio a través de la Asignación Excesiva (CAPEC-130). Un usuario con privilegios de búsqueda puede enviar una solicitud de búsqueda especialmente diseñada que provoca que un nodo de datos agote la memoria heap disponible, lo que resulta en la indisponibilidad del nodo y la degradación del clúster. Un atacante podría aprovechar esta vulnerabilidad para causar tiempo de inactividad del clúster que requiere intervención manual para restaurar el servicio.

Information

Published : 2026-07-21 21:16

Updated : 2026-10-24 19:10

NVD link : CVE-2026-63136

Mitre link : CVE-2026-63136

CVE.ORG link : CVE-2026-63136

JSON object : View

Products Affected

elastic

elasticsearch

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-63136", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63136", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T19:31:50.834030Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@elastic.co", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@elastic.co", "affectedData": [{"vendor": "Elastic", "product": "Elasticsearch", "versions": [{"status": "affected", "version": "8.0.0", "versionType": "semver", "lessThanOrEqual": "8.19.14"}, {"status": "affected", "version": "9.3.0", "versionType": "semver", "lessThanOrEqual": "9.3.3"}, {"status": "affected", "version": "9.0.0", "versionType": "semver", "lessThanOrEqual": "9.2.8"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-21T21:16:52.850", "references": [{"url": "https://discuss.elastic.co/t/elasticsearch-8-19-15-9-2-9-9-3-4-security-update-esa-2026-60/388559", "tags": ["Vendor Advisory"], "source": "security@elastic.co"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@elastic.co", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage this vulnerability to cause cluster downtime requiring manual intervention to restore service."}, {"lang": "es", "value": "El Consumo de Recursos No Controlado (CWE-400) en Elasticsearch puede conducir a una denegaci\u00f3n de servicio a trav\u00e9s de la Asignaci\u00f3n Excesiva (CAPEC-130). Un usuario con privilegios de b\u00fasqueda puede enviar una solicitud de b\u00fasqueda especialmente dise\u00f1ada que provoca que un nodo de datos agote la memoria heap disponible, lo que resulta en la indisponibilidad del nodo y la degradaci\u00f3n del cl\u00faster. Un atacante podr\u00eda aprovechar esta vulnerabilidad para causar tiempo de inactividad del cl\u00faster que requiere intervenci\u00f3n manual para restaurar el servicio."}], "lastModified": "2026-10-24T19:10:00.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A0AD9E6-045D-466C-AC15-33E38E06E7D4", "versionEndExcluding": "8.19.15", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF20189B-F2C1-4D65-A484-3BE8B7572F05", "versionEndExcluding": "9.2.9", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DFD9CD8D-4075-4FC6-9DFF-3C3116BAA08C", "versionEndExcluding": "9.3.4", "versionStartIncluding": "9.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@elastic.co"}