UpHeron
All vulnerabilities

Servers and applications

CVE-2026-63136

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage this vulnerability to cause cluster downtime…

Severity
Medium 6.5
Published
21 Jul 2026
Last changed
7 Aug 2026
Added to UpHeron
21 Oct 2026
Fixed in
8.19.15, 9.2.9, 9.3.4
Sources
NVD

Affected software

SoftwareAffected versions
ElasticsearchServers and applications · cpe:a:elastic:elasticsearch
  • From 8.0.0 before 8.19.15
  • From 9.0.0 before 9.2.9
  • From 9.3.0 before 9.3.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-63136
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-63136