CVE-2026-94399: Elastic Elasticsearch DOS Vulnerability

CVE-2026-94399 is a denial of service vulnerability in Elastic Elasticsearch caused by uncontrolled resource consumption. Attackers can exploit this flaw to exhaust system resources through excessive allocation. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-94399 Overview

CVE-2026-94399 is an uncontrolled resource consumption vulnerability [CWE-400] affecting Elastic Elasticsearch. The flaw allows an authenticated attacker to trigger excessive memory or resource allocation (CAPEC-130), resulting in denial of service against the search cluster. The issue is addressed in Elasticsearch versions 8.19.22, 9.4.7, and 9.5.4 as described in Elastic Security Advisory ESA-2026-180.

Because Elasticsearch frequently serves as the backing store for logging, observability, and search workloads, availability loss can cascade into dependent applications and SIEM pipelines.

Critical Impact
An authenticated low-privileged user can send crafted requests that exhaust cluster resources and disrupt availability of production search and logging services.

Affected Products

Elastic Elasticsearch prior to 8.19.22
Elastic Elasticsearch 9.x prior to 9.4.7
Elastic Elasticsearch 9.5.x prior to 9.5.4

Discovery Timeline

2026-09-26 - CVE-2026-94399 published to NVD
2026-09-29 - Last updated in NVD database
ESA-2026-180 - Elastic releases fixed versions 8.19.22, 9.4.7, and 9.5.4

Technical Details for CVE-2026-94399

Vulnerability Analysis

The vulnerability is categorized as uncontrolled resource consumption [CWE-400]. Elasticsearch does not sufficiently bound the memory or compute cost of certain request paths. An authenticated attacker can submit requests that cause the server to allocate disproportionate resources relative to the request size.

Successful exploitation degrades or halts Elasticsearch node operation. Impact is confined to availability; confidentiality and integrity are not affected. The EPSS probability currently sits at 0.411%, reflecting a lower observed likelihood of exploitation in the wild.

For environments running Elasticsearch as the primary log store, outage of the cluster can suspend ingestion, break Kibana dashboards, and interrupt downstream detection workflows.

Root Cause

The root cause is missing or insufficient limits on resource allocation during request handling. Elasticsearch allocates data structures sized by attacker-controlled fields without proportional bounds. The fix in 8.19.22, 9.4.7, and 9.5.4 enforces stricter controls on allocation paths. Refer to the Elastic Security Advisory ESA-2026-180 for details.

Attack Vector

The attack vector is network-based and requires low-privileged authentication. An attacker needs valid credentials to the Elasticsearch REST API but does not need administrative rights or user interaction. Any account with access to issue search or index operations against a vulnerable node can trigger the condition.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-94399

Indicators of Compromise

Sudden spikes in Elasticsearch JVM heap usage or garbage collection pauses without a corresponding increase in legitimate workload.
Elasticsearch nodes becoming unresponsive or crashing with OutOfMemoryError entries in elasticsearch.log.
Repeated large or structurally unusual requests from a single authenticated principal.

Detection Strategies

Baseline normal request volume and payload size per authenticated user, then alert on statistical deviations.
Monitor cluster health transitions from green to yellow or red correlated with specific client IPs or API keys.
Review audit logs for repeated 429 or 503 responses tied to the same credential.

Monitoring Recommendations

Enable Elasticsearch audit logging and forward events to a centralized SIEM for correlation.
Track node-level metrics including heap pressure, thread pool rejections, and search latency.
Alert on anomalous API call patterns against /_search, /_bulk, and aggregation endpoints.

How to Mitigate CVE-2026-94399

Immediate Actions Required

Upgrade Elasticsearch to 8.19.22, 9.4.7, or 9.5.4 or later as specified in ESA-2026-180.
Audit API keys and user accounts with access to the cluster and revoke unused credentials.
Place Elasticsearch behind network segmentation so only authorized services can reach the REST API.

Patch Information

Elastic has released fixed versions 8.19.22, 9.4.7, and 9.5.4. Apply the upgrade path appropriate for your deployment per the Elastic Security Update ESA-2026-180. Validate cluster health and reindex compatibility in a staging environment before rolling out to production.

Workarounds

Restrict Elasticsearch cluster access to trusted application tiers using network ACLs or private endpoints.
Enforce role-based access control (RBAC) with least privilege; remove broad read/write cluster privileges from service accounts.
Apply reverse proxy rate limiting and payload size caps in front of Elasticsearch endpoints.
Enable circuit breakers and configure indices.breaker.total.limit conservatively to constrain memory usage per request.

bash

# Example: constrain request size and memory via proxy and Elasticsearch config
# nginx reverse proxy limit
client_max_body_size 10m;

# elasticsearch.yml circuit breaker settings
indices.breaker.total.use_real_memory: true
indices.breaker.total.limit: 70%
indices.breaker.request.limit: 40%