CVE-2026-56143 Overview
CVE-2026-56143 is a denial of service vulnerability in Elasticsearch caused by Allocation of Resources Without Limits or Throttling [CWE-770]. A user with elevated privileges can submit a specially crafted request that triggers excessive memory consumption on the target node. The affected node may become unavailable, disrupting search and indexing operations for dependent applications.
The issue is tracked by Elastic under advisory ESA-2026-47 and addressed in Elasticsearch versions 8.19.20 and 9.3.0. Exploitation requires authenticated access with high privileges, which limits practical attack scenarios to insider threats or compromised administrative accounts.
Critical Impact
A single crafted request from a privileged user can exhaust memory on an Elasticsearch node, rendering it unavailable and disrupting cluster availability.
Affected Products
- Elasticsearch versions prior to 8.19.20
- Elasticsearch 9.x versions prior to 9.3.0
- Self-managed and Elastic Cloud deployments running affected versions
Discovery Timeline
- 2026-09-01 - CVE-2026-56143 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-56143
Vulnerability Analysis
The vulnerability sits in Elasticsearch request handling paths where the service accepts input parameters without enforcing upper bounds on resource allocation. When a privileged user submits a crafted request, the server allocates memory proportional to attacker-controlled values. This behavior falls under Excessive Allocation (CAPEC-130).
The attack results in memory exhaustion on the target node. Java Virtual Machine (JVM) heap pressure builds until garbage collection can no longer reclaim usable memory. The node then stops responding to cluster coordination messages and search or indexing traffic. Neither confidentiality nor integrity is affected — the impact is limited to availability of the affected node.
Root Cause
The root cause is missing throttling and size validation on a specific request pathway in Elasticsearch. The service does not verify that requested allocations fall within safe bounds relative to available heap capacity before processing the operation. This is a classic instance of [CWE-770: Allocation of Resources Without Limits or Throttling].
Attack Vector
The attack originates over the network against the Elasticsearch REST or transport interface. The attacker must hold high privileges — for example, a superuser role or an equivalent role granting access to the vulnerable endpoint. No user interaction is required. Once authenticated, the attacker issues one or more crafted requests that force the node to allocate excessive memory until it becomes unresponsive.
Because Elasticsearch clusters distribute shards across nodes, an attacker who can reach multiple nodes could cascade the impact across the cluster. Full technical details are available in the Elastic Security Update ESA-2026-47.
Detection Methods for CVE-2026-56143
Indicators of Compromise
- Sudden JVM heap saturation on one or more Elasticsearch nodes without a corresponding change in query workload
- Nodes leaving the cluster, OutOfMemoryError entries, or long garbage collection pauses in Elasticsearch logs
- Requests to search, aggregation, or ingestion endpoints containing unusually large numeric parameters or oversized payloads from a single authenticated user
Detection Strategies
- Correlate Elasticsearch audit logs with node-level memory metrics to identify privileged users whose requests precede heap exhaustion events
- Baseline typical request sizes and parameter ranges per user role, then alert on outliers to catch abuse of legitimate credentials
- Monitor for repeated cluster state changes such as node departures and shard reallocations that follow specific API calls
Monitoring Recommendations
- Enable Elasticsearch audit logging and forward events to a centralized analytics platform for retention and correlation
- Track JVM heap usage, garbage collection duration, and rejected task counts as leading indicators of resource-exhaustion attacks
- Alert on administrative or superuser sessions originating from unexpected source addresses or outside change windows
How to Mitigate CVE-2026-56143
Immediate Actions Required
- Upgrade Elasticsearch to version 8.19.20 or 9.3.0, or a later release that contains the ESA-2026-47 fix
- Audit accounts holding elevated privileges and remove roles that are not strictly required for operations
- Rotate credentials for any privileged accounts that show unexplained activity in audit logs
Patch Information
Elastic addressed the issue in Elasticsearch 8.19.20 and 9.3.0. Refer to the Elastic Security Update ESA-2026-47 for the full advisory, affected version ranges, and upgrade guidance. Elastic Cloud deployments should apply the vendor-provided upgrade path.
Workarounds
- Restrict access to Elasticsearch management and search APIs to a minimum set of trusted administrators until the patch is applied
- Enforce network-level controls that limit which hosts can reach Elasticsearch REST and transport ports
- Configure JVM heap alarms and circuit breakers so operators receive early warning if a node approaches memory exhaustion
# Configuration example
# Review privileged roles and remove unnecessary superuser assignments
curl -u elastic -X GET "https://<host>:9200/_security/user?pretty"
curl -u elastic -X GET "https://<host>:9200/_security/role?pretty"
# Verify upgraded version after patching
curl -u elastic -X GET "https://<host>:9200/"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
