Vulnerability in Elasticsearch

[ Description ]Official description

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• CERT-FR25 Sep 2026CERTFR-2026-AVI-1228

  Multiple vulnerabilities in Elastic products Translated from French

  Multiple vulnerabilities have been discovered in Elastic products. Some of them allow an attacker to cause privilege escalation, remote denial of service and a breach of data confidentiality.

  CVE-2026-72662CVE-2026-94398CVE-2026-94396+8 more CVEs
• BSI CERT-Bund24 Sep 2026WID-SEC-2026-3573

  Elasticsearch: Multiple vulnerabilities allow denial of service Translated from German

  CVE-2026-94399CVE-2026-94398CVE-2026-94397+4 more CVEs

[ References ]References

• discuss.elastic.co/t/elasticsearch-9-4-7-9-5-4-security-update-esa-2026-182/390686Vendor Advisory