CVE-2026-56149
CVE-2026-56149 · Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a specially crafted machine learning request that causes excessive memory consumption, which may render the affected node unavailable.
CVSS 4.9 · Medium · EPSS 0.5%
- Published
- Updated
Stack: system
Affected products and versions
elasticsearch
- Versions
- ≥ 9.4.0, ≤ 9.4.2: Affected (semver)
- ≥ 9.0.0, ≤ 9.3.5: Affected (semver)
- ≥ 8.0.0, ≤ 8.19.16: Affected (semver)
No fix published
elasticsearch Ubuntu:16.04:LTS
- Versions
- 1.6.2+dfsg-1
- 1.7.3+dfsg-1
- 1.7.3+dfsg-2
- 1.7.3+dfsg-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published