CVE-2026-49090: Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
Published Jul 1, 2026
·Updated
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk request that causes sustained high CPU consumption, which can render the affected node unable to process requests.
Affected Software
3 affected components
Elastic Elasticsearch
Elastic Elasticsearch>=7.0.0<7.17.24
Elastic Elasticsearch>=8.0.0<8.15.0
Event History
Jul 1, 2026
CVE Published
via MITRE·05:15 PM
Data Sourced
via MITRE·05:15 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-49090?
CVE-2026-49090 has a medium severity rating of 6.5.
2
What type of vulnerability is CVE-2026-49090?
CVE-2026-49090 is an uncontrolled resource consumption vulnerability in Elasticsearch.
3
How does CVE-2026-49090 exploit occur?
CVE-2026-49090 can be exploited by an authenticated user submitting a specially crafted bulk request that causes excessive CPU consumption.
4
What can result from CVE-2026-49090?
CVE-2026-49090 can lead to a denial of service, causing the affected Elasticsearch node to become unresponsive.
5
What software is affected by CVE-2026-49090?
CVE-2026-49090 affects Elastic Elasticsearch.