UpHeron
All vulnerabilities

Servers and applications

CVE-2026-63263

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource exhaustion persists beyond query completion, repeated requests can fully exhaust the available…

Severity
Medium 6.5
Published
22 Jul 2026
Last changed
3 Aug 2026
Added to UpHeron
21 Oct 2026
Fixed in
8.19.19, 9.3.8, 9.4.4
Sources
NVD

Affected software

SoftwareAffected versions
ElasticsearchServers and applications · cpe:a:elastic:elasticsearch
  • From 8.0.0 before 8.19.19
  • From 9.0.0 before 9.3.8
  • From 9.4.0 before 9.4.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-63263
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-63263