CVE-2026-63136: Elasticsearch DoS Vulnerability

CVE-2026-63136 Overview

CVE-2026-63136 is an uncontrolled resource consumption vulnerability [CWE-400] affecting Elasticsearch. An authenticated user holding search privileges can submit a specially crafted search request that forces a data node to exhaust its available Java Virtual Machine (JVM) heap memory. The result is node unavailability and cluster degradation, mapped to the Excessive Allocation attack pattern (CAPEC-130).

Restoring service after exploitation requires manual operator intervention, extending outage duration. Elastic addressed the issue in advisory ESA-2026-60 covering Elasticsearch versions 8.19.15, 9.2.9, and 9.3.4.

Critical Impact
A low-privileged authenticated user can trigger heap exhaustion on Elasticsearch data nodes, causing cluster downtime that requires manual recovery.

Affected Products

Elasticsearch versions prior to 8.19.15
Elasticsearch 9.x versions prior to 9.2.9
Elasticsearch 9.3.x versions prior to 9.3.4

Discovery Timeline

2026-07-21 - CVE-2026-63136 published to the National Vulnerability Database
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63136

Vulnerability Analysis

The flaw stems from insufficient bounds enforcement on memory allocated during specific search request handling paths. When Elasticsearch processes the crafted query, the data node allocates unbounded structures on the JVM heap. The allocation continues until the heap is exhausted, at which point the node stops responding to cluster coordination and query traffic.

Because Elasticsearch clusters replicate shard state across data nodes, degradation on one node forces the master to reroute shards. If multiple nodes are targeted in sequence, cluster-wide search availability collapses. The vulnerability does not expose or modify data, limiting impact to availability.

Exploitation requires only search privileges, which are commonly granted to application service accounts and analyst roles. This lowers the barrier to abuse in shared or multi-tenant deployments.

Root Cause

The root cause is a missing or inadequate resource cap on an internal allocation path used during search request parsing or execution. Elastic has not published exploit-facing detail, but the CWE-400 classification and CAPEC-130 mapping indicate the code path allocates memory proportional to attacker-controlled request fields without enforcing a ceiling.

Attack Vector

The attack vector is network-based against the Elasticsearch REST API. An authenticated user issues a search request containing fields or parameters that trigger the excessive allocation code path. No user interaction is required, and the attacker does not need elevated cluster privileges beyond the ability to submit searches.

No verified proof-of-concept code has been published. Refer to the Elastic Security Update ESA-2026-60 advisory for vendor guidance.

Detection Methods for CVE-2026-63136

Indicators of Compromise

Sudden JVM heap saturation on Elasticsearch data nodes without a corresponding increase in indexing or legitimate query load
OutOfMemoryError entries in Elasticsearch logs originating from search thread pools
Data nodes dropping out of the cluster and requiring restart to rejoin
Repeated search requests from a single principal preceding node instability

Detection Strategies

Correlate Elasticsearch slow-log entries with heap usage metrics from the _nodes/stats API to identify queries that trigger disproportionate allocation
Alert on circuit_breaking_exception events tied to the parent or request circuit breakers exceeding configured limits
Baseline search request patterns per authenticated principal and flag deviations in payload size or query structure

Monitoring Recommendations

Ship Elasticsearch cluster and node logs to a centralized analytics platform for correlation with authentication events
Track jvm.mem.heap_used_percent and node departure events as high-priority telemetry
Enable audit logging for search requests and retain the requesting principal, source IP, and request body signature

How to Mitigate CVE-2026-63136

Immediate Actions Required

Upgrade Elasticsearch to 8.19.15, 9.2.9, or 9.3.4 or later as documented in ESA-2026-60
Inventory service accounts and users granted search privileges and revoke access that is not required for business function
Ensure JVM circuit breaker settings are configured with conservative parent and request limits

Patch Information

Elastic released fixed versions on the schedule documented in Elastic Security Update ESA-2026-60. Apply the patch corresponding to your deployed major version. Elastic Cloud tenants receive the update automatically per Elastic's managed service policy.

Workarounds

Reduce the indices.breaker.request.limit and indices.breaker.total.limit circuit breaker thresholds to fail crafted queries earlier
Place a reverse proxy or API gateway in front of Elasticsearch to inspect and rate-limit search requests per principal
Restrict search privileges to the minimum set of roles required and audit role-mapping configurations

bash

# Tighten Elasticsearch circuit breakers as an interim control
curl -X PUT "https://es.example.local:9200/_cluster/settings" \
  -H "Content-Type: application/json" \
  -u "$ES_ADMIN_USER:$ES_ADMIN_PASS" \
  -d '{
    "persistent": {
      "indices.breaker.request.limit": "40%",
      "indices.breaker.total.limit": "70%",
      "search.max_buckets": 10000
    }
  }'