CVE-2026-94396

Executive Summary

CVE-2026-94396 is an uncontrolled resource consumption vulnerability (CWE-400) in Elasticsearch that allows an authenticated, low-privileged remote attacker to exhaust server resources via excessive allocation, resulting in denial of service. Because the attack requires only network access and low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base score 6.5), any tenant, application user, or compromised low-privilege credential with API access to a reachable Elasticsearch endpoint represents a viable attack path. The impact is confined to availability: successful exploitation can degrade or halt search, indexing, and cluster operations for all users of the affected node or cluster. No public proof-of-concept, Nuclei template, or exploit code is currently available, and no vendor patch has been identified across tracked sources.

Technical Analysis

The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and maps to CAPEC-130 (Excessive Allocation). In the abstract, this class of flaw occurs when an application accepts attacker-influenced input that governs the size, quantity, or lifetime of an internal resource allocation — memory buffers, thread pools, file handles, queue entries, or similar — without enforcing adequate bounds, quotas, or rate limits. The attacker supplies input that causes the process to allocate or retain resources disproportionate to the request's legitimate cost, eventually starving the service of the capacity it needs to serve other clients.

In an Elasticsearch context, the affected attack surface is the externally reachable HTTP/REST API and the transport layer through which clients submit requests. Resource-intensive operations — queries, aggregations, bulk ingestion, or script execution — are the natural candidates for an allocation-abuse primitive, because these are the code paths where user-supplied parameters directly drive work performed by the JVM heap, native memory, and the search thread pools. The CVSS vector confirms the essential characteristics: the attacker is remote (AV:N), the attack is straightforward to execute with no special conditions (AC:L), it requires only low privileges (PR:L), no user interaction is needed (UI:N), and the sole resulting impact is to availability (C:N/I:N/A:H).

Notably, the provided NVD description does not specify the exact API endpoint, parameter, query type, or code component responsible for the uncontrolled allocation. It is therefore not possible to state which request field, aggregation type, or internal class is implicated. Analysts should treat the precise trigger as unconfirmed and validate against the affected product's release notes, security advisories, and any future NVD updates. What can be stated with confidence, based on the CWE and CAPEC mapping, is the weakness class: a missing or inadequate bound on an attacker-controllable resource allocation, exploitable by any party able to issue requests to the cluster.

Because exploitation requires low privileges (PR:L), the threat model differs from an unauthenticated denial-of-service condition. The attacker is assumed to already hold valid credentials or to have reached the cluster through an application that proxies requests with its own service account. This lowers the bar for insiders, compromised tenants, and any environment where Elasticsearch is exposed with weak or shared credentials. The absence of confidentiality and integrity impact (C:N/I:N) further indicates that the flaw does not expose or corrupt data — its effect is purely resource exhaustion and the resulting loss of service availability.

The lack of a published affected-version range and the absence of patch evidence from any tracked source are material gaps. Until a vendor advisory is published, defenders cannot rely on version-based scoping and must instead audit all deployed Elasticsearch instances for exposure, resource limits, and access controls.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for CVE-2026-94396. The attack chain below is therefore described at the vulnerability-class level, consistent with CWE-400 / CAPEC-130 and the provided CVSS vector. No specific endpoint, parameter, or function name is asserted, because none is present in the source data.

1. Reconnaissance and target identification. The attacker identifies an exposed Elasticsearch HTTP/REST interface, commonly by scanning for the default service port or by fingerprinting responses and titles associated with Elasticsearch. Shodan-style discovery using the product/title/html dorks in the metadata section can enumerate internet-facing instances. The attacker determines whether the cluster permits low-privileged authenticated access or is reachable through an application proxy.

2. Obtaining the required low privilege. Because PR:L applies, the attacker either possesses, steals, or is granted a low-privileged credential, or reaches the cluster indirectly through an application whose backend account forwards requests. No user interaction is required (UI:N), so the attack does not depend on tricking an administrator.

3. Triggering the uncontrolled allocation. The attacker submits one or more requests to the exposed API that cause a disproportionately large internal resource allocation relative to the size or cost of the request. Consistent with CAPEC-130, the attacker leverages input that the service does not adequately bound, aiming to consume memory, threads, or compute until the node or cluster can no longer service legitimate traffic. The exact request shape is unconfirmed in available data; in general terms this class of flaw is driven by attacker-controlled size, count, or complexity parameters.

4. Post-exploitation impact. Successful triggering results in resource exhaustion (availability-only impact). Practical outcomes include degraded query latency, rejected requests, search thread pool saturation, node timeouts, circuit-breaker trips, cluster health degradation, and in severe cases node or cluster unavailability. Because the allocation is repeated or amplified, sustained exploitation can create a persistent denial of service that outlasts the initial request burst. No data confidentiality or integrity loss is expected, consistent with C:N/I:N.

Impact Assessment

The CVSS v3.1 base score is 6.5 (Medium), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The subscore analysis is straightforward: Attack Vector Network and Attack Complexity Low indicate the flaw is remotely reachable and requires no special conditions; Privileges Required Low means any authenticated low-privileged principal (or an application acting on its behalf) can attempt it; User Interaction None means the attack is non-interactive; and Scope Unchanged means the impact is contained to the vulnerable component. The confidentiality and integrity impacts are None, while availability is High — the defining characteristic of this vulnerability.

Business impact centers on service availability. Elasticsearch commonly underpins search functionality, log analytics, observability pipelines, and security monitoring. Denial of service against an Elasticsearch cluster can simultaneously take down customer-facing search, break dashboards and alerting, halt log ingestion, and blind security operations that depend on that data. Where Elasticsearch serves multiple tenants or business units, the blast radius is the entire set of consumers of the affected cluster, since resource exhaustion affects all requests served by the saturated node or nodes. Recovery may require restarting nodes, which is itself disruptive and can trigger shard recovery load.

The prerequisites for exploitation — network reachability and low privileges — mean the population at risk is any reachable, multi-tenant or multi-user Elasticsearch deployment. The absence of a public exploit and the unpatched status (0/4 patch confidence) leave this open indefinitely until the vendor publishes a fix or independent mitigations are applied.

Detection Guidance

Detection should focus on abnormal request-driven resource consumption and on the operational symptoms of allocation exhaustion, since no exploit signature is published.

Sigma Rule

title: Elasticsearch Uncontrolled Resource Consumption - DoS Indicator (CVE-2026-94396)
id: 6f2b1c9e-9439-400a-9c1a-000000000001
status: experimental
description: Detects excessive allocation / resource exhaustion patterns against Elasticsearch consistent with CWE-400 (CAPEC-130)
author: valtersit.com
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94396
date: 2026/01/01
logsource:
  product: elasticsearch
  service: server
detection:
  selection_resource:
    - 'java.lang.OutOfMemoryError'
    - 'circuit_breaking_exception'
    - 'too_many_requests'
    - 'rejected execution'
    - 'search thread pool'
    - 'data too large'
  selection_pressure:
    - '* over heap *'
    - 'all shards failed'
    - 'cluster_block_exception'
  condition: 1 of selection_*
falsepositives:
  - Legitimate bulk indexing jobs
  - Backup or reindex operations during maintenance windows
level: medium
tags:
  - attack.t1499
  - cwe.400

YARA Rule

rule CVE_2026_94396_Elasticsearch_Resource_Exhaustion
{
    meta:
        description = "Detects Elasticsearch log artifacts consistent with uncontrolled resource consumption (CWE-400 / CAPEC-130)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94396"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $oom      = "OutOfMemoryError" ascii wide nocase
        $circuit  = "circuit_breaking_exception" ascii wide nocase
        $toomany  = "too_many_requests" ascii wide nocase
        $reject   = "rejected execution" ascii wide nocase
        $overheap = "over heap" ascii wide nocase
        $toobig   = "data too large" ascii wide nocase

    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94396 Elasticsearch Uncontrolled Resource Consumption DoS Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; pcre:"/(_search|_msearch|_bulk|_query)/Ui"; threshold:type both, track by_src, count 50, seconds 10; classtype:attempted-dos; reference:cve,2026-94396; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94396; metadata:confidence low, created_at 2026_01_01; sid:202694396; rev:1;)

Elastic Detection

// EQL: correlate spikes in search requests with resource-exhaustion symptoms
sequence by host.name with maxspan=5m
  [ any where event.category == "web" and
      url.path : ("*_search*", "*_msearch*", "*_bulk*") and
      http.response.status_code == 429 ]
  [ any where event.category == "database" and
      message : ("*circuit_breaking_exception*", "*OutOfMemoryError*", "*rejected execution*") ]

Splunk SPL Query

index=elasticsearch sourcetype=elasticsearch:server
| search "circuit_breaking_exception" OR "OutOfMemoryError" OR "rejected execution" OR "too_many_requests" OR "data too large"
| stats count min(_time) as first_seen max(_time) as last_seen by host, source
| where count > 20
| table host, source, count, first_seen, last_seen
| sort - count

Wazuh OSSEC Rule

<group name="elasticsearch,cve-2026-94396,">
  <rule id="100396" level="10">
    <decoded_as>json</decoded_as>
    <field name="message">OutOfMemoryError|circuit_breaking_exception|rejected execution|data too large</field>
    <description>CVE-2026-94396: Possible Elasticsearch resource exhaustion / denial of service (CWE-400)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
  <rule id="100397" level="8">
    <decoded_as>json</decoded_as>
    <field name="http.response.status_code">429</field>
    <description>Elasticsearch returned 429 Too Many Requests - possible resource consumption attack</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations.

• Restrict network exposure: ensure Elasticsearch is not reachable from untrusted networks or the public internet. Bind to internal interfaces, enforce firewall allow-lists, and require TLS and authentication on both REST and transport layers.
• Enforce least privilege: audit and reduce the privileges of low-privileged accounts and application proxy accounts, since PR:L is the required privilege level. Apply role-based access control so that only necessary API operations are permitted per principal.
• Apply resource governance: configure query and search limits, request timeouts, circuit breakers, and thread pool queue bounds where the product supports them, to cap resource consumption per request and per client.
• Rate-limit and monitor: apply request rate limiting at the proxy/ingress layer, and alert on 429 responses, circuit-breaker trips, and OutOfMemoryError events.
• Isolate workloads: separate multi-tenant workloads into distinct clusters or nodes so that one abusive tenant cannot exhaust resources shared by others.

2. Patch/upgrade steps.

• No vendor patch or fixed version has been identified. Monitor the Elastic security advisory channel and the NVD entry for CVE-2026-94396 for an authoritative fixed version, then upgrade all nodes in a coordinated rolling fashion. Do not assume any specific version is fixed until the vendor confirms it.

3. Long-term hardening.

• Maintain a documented vulnerability management process that tracks Elasticsearch advisories and applies updates promptly.
• Deploy in a defense-in-depth architecture: reverse proxy with authentication, WAF/rate limiting in front of the cluster, and network segmentation.
• Continuously monitor resource utilization baselines and alert on anomalous allocation growth to detect exploitation attempts early.
• Conduct periodic access reviews to eliminate stale or excessive privileges that could satisfy the PR:L precondition.

References

1. NVD — CVE-2026-94396: https://nvd.nist.gov/vuln/detail/CVE-2026-94396
2. CWE-400 — Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
3. CAPEC-130 — Excessive Allocation: https://capec.mitre.org/data/definitions/130.html
4. MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
5. Elastic Security Advisories (monitor for vendor fix): https://www.elastic.co/community/security

Threat actor campaign data and exploit-in-the-wild evidence: none identified. CISA KEV: NO. No public PoC, Nuclei template, or exploit code is available for this CVE at the time of writing.