CVE-2026-56149: Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a specially crafted machine learning request that causes excessive memory consumption, which may render the affected node unavailable.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56149?
The severity of CVE-2026-56149 is rated as medium with a score of 4.9.
What kind of vulnerability is CVE-2026-56149?
CVE-2026-56149 is a vulnerability related to the allocation of resources without limits or throttling in Elasticsearch.
How does CVE-2026-56149 affect Elasticsearch?
CVE-2026-56149 can lead to a denial of service due to excessive memory consumption from specially crafted machine learning requests.
Who is affected by CVE-2026-56149?
Users with elevated privileges in Elasticsearch are capable of exploiting CVE-2026-56149.
What can be done to mitigate CVE-2026-56149?
To mitigate CVE-2026-56149, it is recommended to implement resource limits and throttling for machine learning requests in Elasticsearch.