CVE-2026-56145: Elasticsearch DOS Vulnerability

CVE-2026-56145 Overview

CVE-2026-56145 is an uncontrolled resource consumption vulnerability [CWE-400] in Elasticsearch. A low-privileged authenticated user with permission to execute Event Query Language (EQL) sequence queries against an index they control can send a specially crafted query. The query triggers excessive memory allocation, causing the target Elasticsearch node to crash. This maps to the Excessive Allocation attack pattern (CAPEC-130) and results in a denial of service condition affecting cluster availability.

Critical Impact
An authenticated attacker with minimal privileges can crash Elasticsearch nodes by submitting a crafted EQL sequence query, disrupting search and indexing operations for all cluster consumers.

Affected Products

Elasticsearch versions prior to 8.19.18
Elasticsearch versions prior to 9.3.7
Elasticsearch versions prior to 9.4.4

Discovery Timeline

2026-07-21 - CVE CVE-2026-56145 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-56145

Vulnerability Analysis

The vulnerability resides in the Elasticsearch EQL sequence query engine. EQL sequence queries correlate events across a time window and require the engine to buffer intermediate state. When a crafted query is issued, Elasticsearch fails to enforce sufficient bounds on the memory used to track sequence state. The node consumes memory until the Java Virtual Machine exhausts the heap and the process terminates.

Exploitation requires authentication and permission to run EQL queries against an index the attacker controls. The attack originates over the network against the Elasticsearch REST API. User interaction is not required, and the impact is limited to availability. Confidentiality and integrity are not affected.

Root Cause

The root cause is missing or inadequate resource limits within the code path that materializes EQL sequence results. The engine allocates data structures proportional to attacker-controlled query parameters without capping total memory usage. This satisfies the conditions for [CWE-400] Uncontrolled Resource Consumption.

Attack Vector

An authenticated attacker sends a crafted EQL sequence query to the _eql/search endpoint on an index they can access. The query is shaped to force the engine into an execution pattern that repeatedly allocates memory without release. The Elasticsearch node runs out of heap and crashes, removing it from the cluster and degrading service for other tenants. Refer to the Elastic Discuss Security Update ESA-2026-57 for the vendor description.

Detection Methods for CVE-2026-56145

Indicators of Compromise

Repeated OutOfMemoryError entries in Elasticsearch logs on nodes serving EQL queries.
Unexpected node departures from the cluster followed by JVM heap dump generation.
Spikes in _eql/search request volume from a single authenticated principal or API key.
Sudden heap utilization climbs on data nodes coinciding with sequence query execution.

Detection Strategies

Alert on Elasticsearch node crashes correlated with _eql/search activity in the audit log.
Baseline normal EQL query complexity and flag outliers in field counts and sequence length.
Correlate slow-query log entries with subsequent JVM heap pressure metrics.

Monitoring Recommendations

Ship Elasticsearch audit logs and JVM metrics to a centralized analytics platform for correlation.
Monitor per-user query rates against the EQL API and enforce rate thresholds.
Track cluster health transitions and node restart events tied to memory exhaustion.

How to Mitigate CVE-2026-56145

Immediate Actions Required

Upgrade Elasticsearch to 8.19.18, 9.3.7, or 9.4.4 or later as documented in ESA-2026-57.
Audit role mappings and remove EQL query privileges from accounts that do not require them.
Restrict which indices low-privileged users can create or control to reduce attack surface.

Patch Information

Elastic addressed CVE-2026-56145 in Elasticsearch 8.19.18, 9.3.7, and 9.4.4. Patch details are available in the Elastic Discuss Security Update ESA-2026-57. Apply the update to all cluster nodes and confirm the version through the GET / endpoint.

Workarounds

Revoke the read and index creation privileges required to execute EQL sequence queries from untrusted principals.
Place Elasticsearch behind an authenticating proxy that filters or rate-limits requests to _eql/search.
Isolate sensitive indices onto dedicated nodes so that a crash does not disrupt unrelated workloads.

bash

# Configuration example: remove EQL query permission from a role
curl -X PUT "https://es.example.local:9200/_security/role/analyst_readonly" \
  -H "Content-Type: application/json" \
  -u elastic:$ES_PASSWORD \
  -d '{
    "indices": [
      {
        "names": [ "logs-*" ],
        "privileges": [ "read" ],
        "allow_restricted_indices": false
      }
    ]
  }'