Threat Investigation
Request a demo

CVE-2026-56143

Medium

Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a specially crafted request that causes excessive memory consumption, which may render the affected node unavailable.

SeverityMedium
CVSS4.9
Exploit probability—
ProductElasticsearch
PublishedSep 1, 2026
First seenSep 1, 2026
Weakness typeCWE-770Allocation of resources without limits

How to fix

Update
  • elastic elasticsearch8.19.20, 9.3.0 or later

Affected products

ProductAffected versionsFixed in
elastic elasticsearch8.0.0 ≤ v < 8.19.20, 9.0.0 ≤ v < 9.3.08.19.20, 9.3.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.