Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Elasticsearch can become unresponsive due to resource overload

CVE-2026-82294 · published 1 month ago
Summary

Elasticsearch may use too much memory or CPU when handling certain requests, causing the service to slow down or stop responding. This can affect any system that relies on Elasticsearch for search or analytics, potentially interrupting business operations. Apply the latest Elasticsearch updates and limit or monitor heavy queries to prevent the overload.

What to do
  • Update elasticsearch to version 9.5.3.
Affected software
Ecosystem VendorProductAffected versions
– elastic elasticsearch <= 8.19.20
>= 8.0.0, < 8.19.21
>= 9.0.0, < 9.4.6
>= 9.5.0, < 9.5.3
Bitnami – elasticsearch >= 9.5.0, < 9.5.3
Fix: upgrade to 9.5.3
Original advisory text
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published26 Sep 2026
Updated4 Nov 2026
First seen26 Sep 2026
Sources
CVE-2026-82294 · NVD
CVE-2026-82294 · MITRE
CVE-2026-82294 · OSV
BIT-elasticsearch-2026-82294 · OSV
Track software like this
Free during beta