CVE-2026-63263

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource exhaustion persists beyond query completion, repeated requests can fully exhaust the available query worker resources, rendering ES|QL queries unavailable until the node is restarted.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-74/388577	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:elastic:elasticsearch::::::::
	cpe:2.3:a:elastic:elasticsearch::::::::
	cpe:2.3:a:elastic:elasticsearch::::::::

History

24 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Consumo de Recursos No Controlado (CWE-400) en Elasticsearch puede llevar a denegación de servicio a través de Expansión Exponencial de Datos (CAPEC-197). Un usuario autenticado puede enviar una consulta especialmente diseñada al motor ES\|QL que causa un consumo exponencial de CPU durante la evaluación de la consulta. Debido a que el agotamiento de recursos persiste más allá de la finalización de la consulta, las solicitudes repetidas pueden agotar completamente los recursos disponibles del trabajador de consultas, dejando las consultas ES\|QL no disponibles hasta que se reinicie el nodo.

Information

Published : 2026-07-22 00:17

Updated : 2026-10-24 17:10

NVD link : CVE-2026-63263

Mitre link : CVE-2026-63263

CVE.ORG link : CVE-2026-63263

JSON object : View

Products Affected

elastic

elasticsearch

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-63263", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63263", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T13:04:18.223493Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@elastic.co", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@elastic.co", "affectedData": [{"vendor": "Elastic", "product": "Elasticsearch", "versions": [{"status": "affected", "version": "9.4.0", "versionType": "semver", "lessThanOrEqual": "9.4.3"}, {"status": "affected", "version": "9.0.0", "versionType": "semver", "lessThanOrEqual": "9.3.7"}, {"status": "affected", "version": "8.0.0", "versionType": "semver", "lessThanOrEqual": "8.19.18"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-22T00:17:31.283", "references": [{"url": "https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-74/388577", "tags": ["Vendor Advisory"], "source": "security@elastic.co"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@elastic.co", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource exhaustion persists beyond query completion, repeated requests can fully exhaust the available query worker resources, rendering ES|QL queries unavailable until the node is restarted."}, {"lang": "es", "value": "Consumo de Recursos No Controlado (CWE-400) en Elasticsearch puede llevar a denegaci\u00f3n de servicio a trav\u00e9s de Expansi\u00f3n Exponencial de Datos (CAPEC-197). Un usuario autenticado puede enviar una consulta especialmente dise\u00f1ada al motor ES|QL que causa un consumo exponencial de CPU durante la evaluaci\u00f3n de la consulta. Debido a que el agotamiento de recursos persiste m\u00e1s all\u00e1 de la finalizaci\u00f3n de la consulta, las solicitudes repetidas pueden agotar completamente los recursos disponibles del trabajador de consultas, dejando las consultas ES|QL no disponibles hasta que se reinicie el nodo."}], "lastModified": "2026-10-24T17:10:00.220", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96C3FAF7-B843-402F-A3C1-543138429355", "versionEndExcluding": "8.19.19", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EDAA3E3F-D854-4D29-BB31-20A947C9EB1A", "versionEndExcluding": "9.3.8", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54F14824-0093-4DA8-95AD-ED8F481722FC", "versionEndExcluding": "9.4.4", "versionStartIncluding": "9.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@elastic.co"}