{"id":"CVE-2026-56145","title":"Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)","summary":"Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL sequence queries against an index they co…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-400"],"vendor":"elastic","product":"elasticsearch","affected":["elasticsearch >= 8.0.0, < 8.19.18","elasticsearch >= 9.0.0, < 9.3.7","elasticsearch >= 9.4.0, < 9.4.4"],"patched":["elasticsearch 9.4.4"],"published":"2026-07-21","updated":"2026-08-07","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56145","references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-19-18-9-3-7-9-4-4-security-update-esa-2026-57/388556","label":"security@elastic.co"}],"tags":["nvd"],"epss":0.00332,"epssPercentile":0.26665,"ingestedAt":"2026-08-07T22:17:38.407Z","slug":"CVE-2026-56145","body":"## Overview\n\nUncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL sequence queries against an index they control can send a specially crafted query that triggers excessive memory consumption, causing the Elasticsearch node to crash.\n\n## Affected\n\n- `elasticsearch >= 8.0.0, < 8.19.18`\n- `elasticsearch >= 9.0.0, < 9.3.7`\n- `elasticsearch >= 9.4.0, < 9.4.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `elasticsearch 9.4.4`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}