CVE-2026-94398: Elastic Elasticsearch DOS Vulnerability

CVE-2026-94398 Overview

CVE-2026-94398 is an uncontrolled resource consumption vulnerability [CWE-400] affecting Elastic Elasticsearch. An authenticated attacker with low privileges can trigger excessive memory or CPU allocation over the network, causing a denial of service against the cluster. The flaw aligns with CAPEC-130 (Excessive Allocation) and impacts availability without exposing confidentiality or integrity.

Elastic published fixed releases in versions 8.19.22, 9.4.7, and 9.5.4 under advisory ESA-2026-179. Organizations running affected Elasticsearch clusters that accept queries from authenticated users should prioritize patching, as the attack requires only network reachability and valid credentials.

Critical Impact
An authenticated attacker can cause Elasticsearch nodes to exhaust resources, resulting in cluster-wide denial of service and disruption of search, logging, and analytics workloads.

Affected Products

Elastic Elasticsearch versions prior to 8.19.22
Elastic Elasticsearch 9.x versions prior to 9.4.7
Elastic Elasticsearch 9.5.x versions prior to 9.5.4

Discovery Timeline

2026-09-26 - CVE-2026-94398 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-94398

Vulnerability Analysis

The vulnerability stems from Elasticsearch failing to properly bound resource allocation when processing certain requests from authenticated users. An attacker submits crafted requests that force the server to allocate memory, CPU cycles, or other resources beyond safe limits.

Because Elasticsearch sits at the center of logging, search, and analytics pipelines, exhausting node resources cascades into downstream service failures. The attack requires authentication but no user interaction, and complexity is low. Only availability is affected; the attacker cannot read or modify indexed data through this flaw.

The issue is categorized under CAPEC-130 (Excessive Allocation), where an attacker provokes a target into reserving more resources than it should. Elastic's advisory ESA-2026-179 tracks the fix across the 8.x and 9.x branches.

Root Cause

The root cause is missing or insufficient limits on resource allocation within request-handling code paths. When an authenticated client sends a request matching the vulnerable pattern, Elasticsearch allocates resources proportional to attacker-controlled input without enforcing an upper bound. Repeated or large requests then drive memory or CPU usage to levels that destabilize the node.

Attack Vector

Exploitation is remote and network-based. The attacker needs valid Elasticsearch credentials with low privileges, which is a realistic scenario in multi-tenant clusters, API-exposed deployments, or environments where tokens leak through logs or client-side code. No user interaction is required, and the attack can be scripted to repeatedly hit vulnerable endpoints until nodes become unresponsive or crash.

Refer to the Elastic Security Update ESA-2026-179 for authoritative technical details.

Detection Methods for CVE-2026-94398

Indicators of Compromise

Sudden spikes in JVM heap usage, garbage collection activity, or CPU utilization on Elasticsearch nodes without a corresponding increase in legitimate query volume
Repeated OutOfMemoryError entries or circuit breaker exceptions in Elasticsearch logs tied to a single authenticated user or API key
Node disconnects, cluster yellow or red state transitions, and shard reallocations correlated with specific client source addresses

Detection Strategies

Baseline normal query patterns per user and alert on authenticated clients that deviate sharply in request size, frequency, or resource cost
Monitor Elasticsearch slow logs and audit logs for anomalous request shapes against sensitive endpoints
Correlate network telemetry with cluster health metrics to identify low-privileged accounts triggering resource pressure

Monitoring Recommendations

Enable Elasticsearch audit logging and ship logs to a centralized SIEM for retention and correlation
Instrument node-level metrics (heap, CPU, thread pool rejections, circuit breaker trips) with alert thresholds
Track per-API-key and per-user request rates to detect abuse patterns consistent with resource exhaustion attempts

How to Mitigate CVE-2026-94398

Immediate Actions Required

Upgrade Elasticsearch to version 8.19.22, 9.4.7, 9.5.4, or later as documented in ESA-2026-179
Audit and rotate API keys and user credentials, revoking any accounts that no longer require cluster access
Review role-based access control to ensure users hold only the minimum privileges necessary

Patch Information

Elastic released fixed builds for the 8.x and 9.x branches. Apply version 8.19.22 for the 8.19 line, 9.4.7 for the 9.4 line, and 9.5.4 for the 9.5 line. See the Elastic Security Update ESA-2026-179 for release notes and upgrade guidance.

Workarounds

Restrict network access to Elasticsearch APIs using firewalls, security groups, or service meshes so only trusted clients can authenticate
Enforce request-size limits and tune circuit breaker settings to constrain memory consumption per request
Rate-limit authenticated clients at a reverse proxy or API gateway in front of Elasticsearch until patching is complete

bash

# Example: tighten Elasticsearch circuit breaker and request limits in elasticsearch.yml
indices.breaker.total.use_real_memory: true
indices.breaker.total.limit: 70%
indices.breaker.request.limit: 40%
http.max_content_length: 50mb