CVE-2026-94397

Executive Summary

CVE-2026-94397 is an uncontrolled resource consumption vulnerability (CWE-400) affecting Elasticsearch, allowing an authenticated attacker to trigger excessive resource allocation and cause a denial-of-service condition. With a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the flaw is remotely reachable, requires low privileges, and results in a high availability impact while confidentiality and integrity remain unaffected. No public proof-of-concept, exploit code, or Nuclei template is currently available, and the CVE has not been added to CISA KEV.

Technical Analysis

The NVD description classifies this issue as Uncontrolled Resource Consumption (CWE-400) leading to denial of service via Excessive Allocation (CAPEC-130). CWE-400 describes a weakness in which a product fails to properly control the allocation and maintenance of a limited resource, allowing the consumption of more resources than intended. CAPEC-130 ("Excessive Allocation") is the corresponding attack pattern, in which an adversary causes a system to allocate resources (memory, CPU, disk, file handles, thread pools, or similar) at a rate or volume that exceeds the system's capacity to sustain operation.

For Elasticsearch specifically, this class of vulnerability typically manifests when a request that requires a disproportionate amount of server-side work relative to its input size is accepted without adequate bounding. Because the resource is exhausted on the server rather than the client, an attacker does not need high bandwidth or many connections — only a request pattern that scales server-side consumption super-linearly. The CVSS vector reflects this: PR:L indicates that the attacker must possess valid credentials sufficient to reach the vulnerable code path, while AV:N and AC:L indicate the condition is reachable over the network with no special environmental preconditions.

The description does not disclose which specific Elasticsearch capability, request type, or component is affected, and no vendor advisory, affected version range, or patch reference is present in the tracked intelligence. Any claim about a specific API endpoint, request parameter, query structure, or internal function being responsible would be speculation and is therefore not made here. Analysts should treat the specific trigger as uncharacterized and rely on the weakness class plus CAPEC-130 for modeling. The practical operational consequence — a single low-privileged authenticated principal able to drive the node toward resource exhaustion and loss of availability — is nonetheless well defined.

Elasticsearch's architecture amplifies the significance of this weakness class. The product is a distributed system in which a single over-consuming node can be pulled from the cluster by the master, force shard reallocation, degrade search and indexing latency cluster-wide, and in severe cases induce a cascade (reallocation load generating additional allocation pressure on remaining nodes). Because CWE-400 affects the availability of the service rather than the integrity or confidentiality of stored data, the primary risk is to uptime and to dependent applications, not to data disclosure.

Exploitation Scenarios

1) Reconnaissance and target identification. Elasticsearch nodes are commonly reachable over the network on their HTTP transport and are frequently fingerprinted by banner and response characteristics. An adversary with any set of valid low-privileged credentials — a leaked API key, a compromised application service account, a default or weakly managed user, or a lateral position inside the network — can enumerate the cluster and confirm it is reachable and responsive.

2) Triggering the flaw class. Once authenticated, the attacker issues requests that the server accepts and processes but which cause disproportionate resource allocation on the target node. Because the description identifies the mechanism only at the class level (Excessive Allocation, CAPEC-130), the precise request shape is not publicly characterized; the attack model is "repeatable, low-privilege requests that each force the server to allocate far more resource than the request's apparent cost." This is the defining property of CAPEC-130 and does not require malformed input — legitimate request syntax is sufficient.

3) Execution method. At the vulnerability-class level, no code injection, memory corruption, or payload delivery is involved. The "payload" is request volume and request shape. An attacker can automate repeated invocation from a single authenticated session or distribute it across sessions (PR:L is satisfied by any one valid principal, and the adversary is not limited to one). No public PoC is available for this CVE; the attack chain above is inferred from the vulnerability class and CVSS characteristics, not from a published exploit.

4) Post-exploitation impact. The immediate effect is degraded or failed service: memory pressure, garbage-collection pauses, thread pool saturation, request timeouts, and potential node or cluster unavailability. An attacker who is already inside the environment could use the induced instability as a diversion while conducting other activity, or could use repeated triggering to hold availability down for an extended period. There is no confidentiality or integrity impact per the CVSS subscores, so data theft and tampering are not expected consequences of this CVE alone.

Impact Assessment

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H yields a base score of 6.5 (Medium). Subscores:

• Attack Vector (Network): the vulnerable behavior is reachable over the network rather than requiring local or physical access.
• Attack Complexity (Low): no special conditions, race windows, or prior state are required.
• Privileges Required (Low): the attacker needs a valid low-privileged account or credential; anonymous access is not assumed.
• User Interaction (None): no victim must be tricked into an action.
• Scope (Unchanged): the impact is confined to the same security authority.
• Confidentiality (None): no data disclosure vector.
• Integrity (None): no data modification vector.
• Availability (High): the sole and severe impact — service availability can be substantially degraded or denied.

Business impact centers on downtime and degradation of every application, dashboard, search feature, and log pipeline that depends on the affected cluster. Elasticsearch commonly sits on the critical path of observability, security analytics (SIEM backends), and customer-facing search, so an availability loss has a broad blast radius including detection blind spots while the platform is down. The PR:L requirement reduces exposure from the open internet but does not reduce it to negligible: shared service accounts, over-permissioned application identities, and credentials exposed in application configuration are common. Because no patch evidence exists from tracked sources (confidence 0/4), an organization running an affected cluster should assume exposure persists until the vendor publishes guidance. No affected version range is provided, so version-level scoping is not possible from this data alone.

Detection Guidance

Sigma Rule

title: Potential Elasticsearch Uncontrolled Resource Consumption DoS (CVE-2026-94397)
id: 6b2f1c7a-9d34-4e58-b1a2-0c7e5f4d9a10
status: experimental
description: Detects repeatable low-privileged Elasticsearch requests whose volume or shape correlates with excessive server-side resource allocation leading to denial of service.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94397
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1499
  - cwe.400
logsource:
  category: web
  product: elasticsearch
detection:
  selection_service:
    service: 'elasticsearch'
  selection_volume:
    status: 200
  timeframe: 5m
  condition: selection_service and selection_volume | count() by src_ip > 300
fields:
  - src_ip
  - user
  - url
  - status
  - response_time_ms
falsepositives:
  - Legitimate bulk indexing or large aggregation workloads
  - Backup or reindex operations from trusted hosts
level: medium

The rule intentionally thresholds on volume per source rather than on a specific URL, because the vulnerable request shape is not publicly documented. Tune the count and window to the cluster's normal query baseline.

YARA Rule

rule CVE_2026_94397_Elasticsearch_DoS_Indicators
{
    meta:
        description = "Detects request bursts and resource-exhaustion indicators associated with CVE-2026-94397 (CWE-400 resource consumption) in captured Elasticsearch traffic or logs"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94397"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $es1 = "Elasticsearch" ascii nocase
        $es2 = "lucene_version" ascii nocase
        $es3 = "\"You Know, for Search\"" ascii
        $err1 = "circuit_breaking_exception" ascii nocase
        $err2 = "TooManyRequests" ascii nocase
        $err3 = "rejected execution" ascii nocase
        $err4 = "out of memory" ascii nocase
        $err5 = "all shards failed" ascii nocase
    condition:
        (1 of ($es1, $es2, $es3)) and 1 of ($err1, $err2, $err3, $err4, $err5)
}

This is a triage rule for log or capture artifacts, not a signature on exploit bytes — no exploit bytes are known for this CVE.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94397 Possible Elasticsearch Resource Exhaustion DoS Attempt"; flow:established,to_server; http.host; content:"9200"; http.response_body; content:"circuit_breaking_exception"; nocase; threshold: type both, track by_src, count 50, seconds 60; classtype:attempted-dos; reference:cve,2026-94397; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94397; sid:9439701; rev:1;)
alert http any any -> any any (msg:"CVE-2026-94397 Elasticsearch Excessive Request Rate to Node"; flow:established,to_server; http.host; content:".es."; nocase; threshold: type both, track by_src, count 300, seconds 60; classtype:attempted-dos; reference:cve,2026-94397; sid:9439702; rev:1;)

Both rules detect the DoS attempt behaviorally (rate plus exhaustion responses) because no exploit-specific payload exists to match on. Adjust the host matching and thresholds to your deployment.

Elastic Detection

sequence by source.ip with maxspan=5m
  [any where event.category == "network" and destination.port == 9200]
  [any where event.category == "network" and destination.port == 9200 and
       (http.response.status_code == 429 or
        elasticsearch.node.stats.jvm.mem.pressure.aggregate_metricset.rate > 0.85)]

Where the cluster is itself shipping logs into Elastic, adding a threshold-based EQL or a detection rule on circuit_breaking_exception and rejected execution events per principal is the most reliable signal. The above sequence correlates sustained request activity from one source with resource-pressure responses.

Splunk SPL Query

index=elasticsearch_logs sourcetype=elasticsearch:server OR sourcetype=elasticsearch:audit
| eval principal=coalesce(user, authentication.token.name, src_ip)
| bin _time span=1m
| stats count AS req_count,
        sum(eval(if(like(_raw,"%circuit_breaking_exception%"),1,0))) AS circuit_breaks,
        sum(eval(if(like(_raw,"%rejected execution%"),1,0))) AS rejected,
        sum(eval(if(like(_raw,"%out of memory%"),1,0))) AS oom
        by _time, principal
| where req_count > 300 OR circuit_breaks > 0 OR rejected > 10 OR oom > 0
| sort - req_count

Tune the request-count threshold against a measured baseline for the cluster; the exception counters (circuit_breaking_exception, rejected execution, out of memory) indicate that resource exhaustion is already occurring and warrant immediate triage.

Wazuh OSSEC Rule

<group name="elasticsearch,cve-2026-94397,web,">
  <rule id="943970" level="10">
    <decoded_as>json</decoded_as>
    <field name="service">elasticsearch</field>
    <field name="status">200</field>
    <description>CVE-2026-94397: High-volume Elasticsearch requests from single source - possible resource exhaustion DoS</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_94397,</group>
  </rule>

  <rule id="943971" level="12">
    <decoded_as>json</decoded_as>
    <match>circuit_breaking_exception|TooManyRequests|rejected execution|out of memory</match>
    <description>CVE-2026-94397: Elasticsearch resource exhaustion indicator observed - availability impact likely</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_94397,</group>
  </rule>
</group>

Rule 943970 depends on your log ingestion normalizing the fields referenced; rule 943971 is a higher-fidelity, higher-severity indicator that resource exhaustion is already in progress.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version range is present in the tracked intelligence. The following guidance is therefore architectural and defensive; it does not substitute for a vendor advisory when one becomes available.

1) Immediate mitigations

• Treat the cluster as exposed: do not rely on network perimeter alone. Restrict access to the Elasticsearch transport and HTTP interfaces using network policy, security groups, and firewall rules so that only authorized application hosts and administrators can reach them.
• Enforce authentication and least privilege. Since PR:L applies, audit every principal with API access, remove unused service accounts, rotate credentials that may appear in application configuration, and ensure no anonymous access is enabled.
• Apply API-level rate limiting and quotas per principal at an ingress proxy or gateway in front of the cluster.
• Monitor and hard-cap resource consumption on the nodes: configure JVM heap limits with headroom to the container/cgroup limit, and ensure circuit breakers and thread-pool rejection settings are at or below defaults rather than relaxed.
• If the organization does not need every API surface, restrict the exposed capabilities to the minimum required by the dependent applications.

2) Patch / upgrade steps

• No patch reference exists in the tracked data. Monitor the vendor's security advisory channel, the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-94397, and the vendor's release notes for an assigned patched version.
• Establish a standing process to upgrade Elasticsearch promptly once a fixed release is identified; test in staging first, since cluster upgrades carry their own availability risk.
• Until a fix is published, treat compensating controls (rate limits, network restriction, per-principal quotas) as the primary line of defense.

3) Long-term hardening

• Build a baseline of normal request rate, query cost, and resource utilization per cluster, and alert on deviation rather than on fixed absolute thresholds alone.
• Enforce per-tenant and per-application rate limits at the gateway as a default, not as an incident response measure.
• Adopt a least-privilege model for all Elasticsearch principals, with periodic access reviews and automated rotation of API keys and service credentials.
• Maintain a staging environment capable of absorbing the request patterns that have caused production impact, and test abnormal input patterns there.
• Include resource-exhaustion scenarios in tabletop and chaos exercises, and verify that cluster degradation does not silently disable downstream detection and logging while the platform is impaired.

References

1. NVD — CVE-2026-94397: https://nvd.nist.gov/vuln/detail/CVE-2026-94397
2. MITRE CWE-400 — Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
3. MITRE CAPEC-130 — Excessive Allocation: https://capec.mitre.org/data/definitions/130.html
4. MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
5. Elastic security advisories portal: https://discuss.elastic.co/c/announcements/security-announcements/

No threat actor campaign, exploit-in-the-wild evidence, public PoC, exploit code, or Nuclei template is associated with CVE-2026-94397 in the tracked intelligence. The CVE is not listed in CISA KEV, and no EPSS score has been assigned by FIRST.org at the time of writing.