CVE-2026-63136: Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage this vulnerability to cause cluster downtime requiring manual intervention to restore service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63136?
The severity of CVE-2026-63136 is rated as medium with a score of 6.5.
How does CVE-2026-63136 impact Elasticsearch?
CVE-2026-63136 can cause uncontrolled resource consumption leading to denial of service due to excessive heap memory allocation.
Who is affected by CVE-2026-63136?
Any user with search privileges can exploit CVE-2026-63136 by submitting a specially crafted search request.
What are the potential consequences of CVE-2026-63136?
The potential consequences of CVE-2026-63136 include data node unavailability and service disruption.
How can I mitigate CVE-2026-63136?
To mitigate CVE-2026-63136, it is recommended to update to the latest version of Elasticsearch that addresses this vulnerability.