CVE-2026-94397: Elastic Elasticsearch DOS Vulnerability

CVE-2026-94397 is a denial of service vulnerability in Elastic Elasticsearch caused by uncontrolled resource consumption. Attackers can exploit excessive allocation to disrupt service availability. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-94397 Overview

CVE-2026-94397 is an uncontrolled resource consumption vulnerability [CWE-400] in Elastic Elasticsearch. An authenticated attacker can trigger excessive memory or CPU allocation (CAPEC-130), causing a denial-of-service condition on the affected cluster. The flaw is network-reachable and requires low privileges, with no user interaction. Elastic addressed the issue in security update ESA-2026-183, covering Elasticsearch versions 8.19.22, 9.4.7, and 9.5.4.

Critical Impact
An authenticated remote attacker can exhaust cluster resources, degrading search and ingest availability for all tenants served by the Elasticsearch node.

Affected Products

Elastic Elasticsearch versions prior to 8.19.22
Elastic Elasticsearch 9.4.x prior to 9.4.7
Elastic Elasticsearch 9.5.x prior to 9.5.4

Discovery Timeline

2026-09-26 - CVE-2026-94397 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-94397

Vulnerability Analysis

The vulnerability is categorized as Uncontrolled Resource Consumption [CWE-400]. Elasticsearch fails to constrain allocation of internal resources when processing specific requests from authenticated users. An attacker with valid credentials can submit crafted queries or API calls that force the node to allocate excessive memory, threads, or CPU cycles. Repeated or sufficiently large requests exhaust available resources and degrade or halt cluster operations. The impact is limited to availability; data confidentiality and integrity remain intact.

Root Cause

The root cause is missing or insufficient enforcement of upper bounds on resource allocation during request handling. Internal code paths accept input dimensions or workloads that scale without a hard cap, allowing allocation to grow beyond safe limits. This matches the Excessive Allocation attack pattern described in CAPEC-130.

Attack Vector

Exploitation requires network access to the Elasticsearch REST or transport API and valid low-privilege credentials. No user interaction is needed. An attacker submits requests that trigger the unbounded allocation path, repeating the operation until the node runs out of heap or CPU capacity. Clustered deployments can see cascading failures as shards are reassigned to already-stressed nodes.

No public proof-of-concept is available. Refer to Elastic's advisory for technical specifics: Elastic Security Update ESA-2026-183.

Detection Methods for CVE-2026-94397

Indicators of Compromise

Sudden spikes in JVM heap utilization or garbage-collection pause times on Elasticsearch nodes without a corresponding ingest or query workload change.
OutOfMemoryError entries or circuit_breaking_exception events in Elasticsearch logs tied to a single authenticated principal or API key.
Repeated high-cost API calls from a single source IP against _search, _msearch, or aggregation endpoints.

Detection Strategies

Correlate authenticated API usage with per-user resource consumption using Elasticsearch audit logs and slow-query logs.
Baseline normal query shapes and alert on anomalous payload sizes, aggregation cardinality, or request volume per API key.
Monitor circuit breaker trip counts (indices.breaker.*) and node-level CPU saturation as early DoS indicators.

Monitoring Recommendations

Enable Elasticsearch audit logging and forward events to a centralized analytics platform for behavioral review.
Track cluster health transitions (green → yellow → red) and node restart events to identify repeated exhaustion patterns.
Alert on sustained thread pool rejections (search, write, bulk) that may indicate deliberate overload.

How to Mitigate CVE-2026-94397

Immediate Actions Required

Upgrade Elasticsearch to 8.19.22, 9.4.7, 9.5.4, or later as directed by ESA-2026-183.
Audit API keys and user accounts with cluster access and revoke credentials that are unused or over-privileged.
Restrict network exposure of the Elasticsearch REST API to trusted application subnets only.

Patch Information

Elastic released fixed builds in security update ESA-2026-183. Apply the patched versions by following the rolling upgrade procedure documented by Elastic. Full advisory details are available at the Elastic Security Update ESA-2026-183.

Workarounds

Enforce request size and query complexity limits using settings such as search.max_buckets, indices.query.bool.max_clause_count, and HTTP body size caps.
Tune circuit breakers (indices.breaker.total.limit, indices.breaker.request.limit) to fail fast on oversized operations.
Apply role-based access control to limit which users can execute expensive aggregation or scripted queries.

bash

# Configuration example: tighten circuit breakers and query limits in elasticsearch.yml
indices.breaker.total.use_real_memory: true
indices.breaker.total.limit: 70%
indices.breaker.request.limit: 50%
search.max_buckets: 10000
http.max_content_length: 50mb