CVE-2026-94396: Elastic Elasticsearch DOS Vulnerability

CVE-2026-94396 Overview

CVE-2026-94396 is an uncontrolled resource consumption vulnerability [CWE-400] affecting Elastic Elasticsearch. An authenticated attacker with low privileges can trigger excessive memory or CPU allocation over the network, leading to denial of service against the cluster. The flaw aligns with CAPEC-130 (Excessive Allocation) and is fixed in Elasticsearch versions 9.4.7 and 9.5.4.

Critical Impact
A low-privileged authenticated user can exhaust server resources and render Elasticsearch nodes unresponsive, disrupting search, indexing, and dependent application workloads.

Affected Products

Elastic Elasticsearch versions prior to 9.4.7
Elastic Elasticsearch versions prior to 9.5.4
Deployments exposing Elasticsearch APIs to authenticated users

Discovery Timeline

2026-09-26 - CVE-2026-94396 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-94396

Vulnerability Analysis

The vulnerability resides in how Elasticsearch handles certain API requests that drive memory or compute allocation. An authenticated client can submit requests that trigger disproportionate internal allocations relative to the input size. This causes the Java Virtual Machine (JVM) heap to grow rapidly or thread workloads to saturate CPU resources. The result is degraded cluster responsiveness or node crashes affecting availability.

The issue is network-reachable and requires low privileges with no user interaction. Impact is limited to availability, with no direct effect on confidentiality or integrity of indexed data. Elastic addressed the issue in the 9.4.7 and 9.5.4 maintenance releases according to the vendor's Elasticsearch 9.4.7 / 9.5.4 Security Update ESA-2026-182.

Root Cause

The root cause is improper limiting of resource allocation during request processing. Elasticsearch did not sufficiently constrain memory or compute consumption for the affected operation. Attackers can repeatedly invoke the operation to amplify allocation pressure well beyond request cost.

Attack Vector

Exploitation requires network access to the Elasticsearch REST or transport API and valid authenticated credentials with minimal privileges. The attacker issues crafted queries or operations that force the node to allocate large data structures or spawn expensive workloads. Repeating the request pattern exhausts heap or CPU and triggers denial of service.

No verified public proof-of-concept code is available. Refer to the vendor advisory for technical specifics on the vulnerable code path.

Detection Methods for CVE-2026-94396

Indicators of Compromise

Sudden spikes in JVM heap utilization or garbage collection pause times on Elasticsearch nodes
Repeated OutOfMemoryError events or node drop-outs from the cluster
High-volume API requests from a single authenticated principal targeting resource-intensive endpoints
Cluster health transitioning to yellow or red without corresponding operational changes

Detection Strategies

Correlate Elasticsearch audit logs with cluster health events to identify request patterns preceding resource exhaustion
Baseline normal query volume and request shapes per user, then alert on anomalies
Monitor node metrics such as jvm.mem.heap_used_percent, CPU utilization, and search thread pool rejections

Monitoring Recommendations

Ship Elasticsearch audit and slow logs to a centralized SIEM for query-level visibility
Enable the Elasticsearch audit log to capture authenticated user actions and API endpoints
Alert on sustained thread pool queue growth, circuit breaker trips, and node disconnects

How to Mitigate CVE-2026-94396

Immediate Actions Required

Upgrade Elasticsearch to version 9.4.7, 9.5.4, or later as published in advisory ESA-2026-182
Restrict network exposure of Elasticsearch APIs to trusted application tiers only
Review and tighten role-based access control (RBAC) to limit which users can execute expensive queries
Enable circuit breakers and request size limits to cap per-request resource consumption

Patch Information

Elastic released fixed versions 9.4.7 and 9.5.4. Review the Elastic security update ESA-2026-182 for upgrade guidance and version-specific release notes.

Workarounds

Enforce rate limiting at a reverse proxy or API gateway in front of Elasticsearch
Revoke or scope down credentials for users who do not require query execution privileges
Configure indices.breaker.total.limit and related circuit breaker settings to reduce blast radius

bash

# Example circuit breaker tuning in elasticsearch.yml
indices.breaker.total.use_real_memory: true
indices.breaker.total.limit: 70%
indices.breaker.request.limit: 40%
indices.breaker.fielddata.limit: 30%