{"id":"CVE-2026-63136","title":"Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130)","summary":"Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhau…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-400"],"vendor":"elastic","product":"elasticsearch","affected":["elasticsearch >= 8.0.0, < 8.19.15","elasticsearch >= 9.0.0, < 9.2.9","elasticsearch >= 9.3.0, < 9.3.4"],"patched":["elasticsearch 9.3.4"],"published":"2026-07-21","updated":"2026-08-07","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63136","references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-19-15-9-2-9-9-3-4-security-update-esa-2026-60/388559","label":"security@elastic.co"}],"tags":["nvd"],"epss":0.0024,"epssPercentile":0.15398,"ingestedAt":"2026-08-07T23:18:01.295Z","slug":"CVE-2026-63136","body":"## Overview\n\nUncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage this vulnerability to cause cluster downtime requiring manual intervention to restore service.\n\n## Affected\n\n- `elasticsearch >= 8.0.0, < 8.19.15`\n- `elasticsearch >= 9.0.0, < 9.2.9`\n- `elasticsearch >= 9.3.0, < 9.3.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `elasticsearch 9.3.4`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}