CVE-2026-94398

Executive Summary

CVE-2026-94398 is an uncontrolled resource consumption (CWE-400) vulnerability in Elasticsearch that can be leveraged to cause a denial of service through excessive resource allocation (CAPEC-130). The vulnerability requires network access and low-privileged authentication (PR:L), meaning an attacker with any valid low-privilege credential can attempt to exhaust server resources without user interaction. Elasticsearch clusters are frequently deployed as shared search and analytics backends, so successful exploitation can degrade or disable not only search functionality but also dependent applications, dashboards, and alerting pipelines.

Technical Analysis

CVE-2026-94398 maps to CWE-400: Uncontrolled Resource Consumption, with the CNA describing the pattern as "Excessive Allocation" (CAPEC-130). In this vulnerability class, the application fails to impose or enforce limits on the amount of a finite resource (memory, CPU, threads, file handles, disk, or network buffers) that a single request, query, or session can consume. An attacker supplies input that causes the service to allocate far more than a normal workload would, or to do so repeatedly, until the node or cluster can no longer service legitimate traffic.

Elasticsearch is a JVM-based distributed search and analytics engine accessed primarily over HTTP/REST on its transport and HTTP ports, and it operates on an internally bounded thread pool and heap model. Because the JVM heap is a hard-bounded resource, allocation pressure that is not absorbed by backpressure mechanisms typically results in long garbage-collection pauses, circuit-breaker interruptions, out-of-memory errors, or node termination. In a multi-node cluster, node loss additionally triggers shard reallocation and recovery traffic, amplifying the original resource pressure across surviving nodes.

Per the supplied intelligence, no affected version range has been published, no vendor fix exists, and no OSV package mapping or workaround is available. The NVD description does not specify the exact request type, parameter, or code path that triggers the excessive allocation; therefore the precise implementation-level trigger cannot be stated with confidence and is not fabricated here. Analysis should remain at the vulnerability-class level: an authenticated but low-privileged actor (PR:L) over the network (AV:N) is sufficient to initiate the resource-exhausting condition. Availability is the only impacted security property (C:N/I:N/A:H), and the scope is unchanged (S:U), which is consistent with degradation of the Elasticsearch service itself rather than secondary compromise of other components.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-94398. The attack chain below is inferred strictly from the vulnerability class (CWE-400 / CAPEC-130 Excessive Allocation) and the CVSS vector; it does not assert specific endpoints, parameters, or function names, because none are present in the available description.

1. Reconnaissance / target identification. An attacker identifies reachable Elasticsearch HTTP interfaces, typically via internet-exposed or internally accessible service ports, banner/response fingerprints, and cluster metadata returned by unauthenticated or low-privileged endpoints. Shodan or internal scanning may be used to enumerate candidate hosts.
2. Credential acquisition. Because the vector specifies PR:L (low privileges required), the attacker needs only a valid low-privilege account — obtainable through credential reuse, leaked API keys, a default or service account, or a low-severity adjacent weakness. No administrative role is required.
3. Triggering the flaw. Using the authenticated low-privilege session, the attacker sends requests that induce excessive allocation. At the class level, this is any operation whose resource cost is disproportionate to the attacker's privileges and is not effectively capped by the service — for example, a request that drives large or repeated internal allocations per invocation. The attacker repeats, parallelizes, or amplifies these requests to exhaust heap, thread pools, or connection capacity on one or more nodes.
4. Post-exploitation impact. Sustained allocation pressure causes latency spikes, circuit-breaker trips, node unavailability, and — in severe cases — JVM out-of-memory termination. The resulting denial of service propagates to every dependent application, dashboard, and ingestion pipeline. Cluster recovery and shard reallocation can prolong the outage beyond the initial attack window.

This vulnerability is not listed in CISA KEV, and there is no tracked exploit-in-the-wild evidence at the time of writing.

Impact Assessment

The CVSS 3.1 base score is 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

• Availability (A:H): The primary impact. Resource exhaustion can render Elasticsearch nodes unresponsive or terminated, causing full or partial service outage.
• Confidentiality / Integrity (C:N / I:N): No direct impact per the vector; the flaw affects service availability rather than data exposure or modification.
• Attack complexity (AC:L): Low — no special conditions or race windows are described.
• Privileges required (PR:L): Low — an attacker needs an authenticated low-privilege account, not admin rights.
• User interaction (UI:N): None — exploitation is server-driven.
• Scope (S:U): Unchanged — impact is confined to the vulnerable service, though dependent applications may experience downstream outage.

Blast radius: Elasticsearch is commonly a shared, central component. An outage can simultaneously affect search, log analytics, SIEM data stores, application backends, and observability dashboards. In clustered deployments, the failure of one node increases load on others and can cascade into cluster-wide degradation, extending recovery time and operational cost. Business impact is primarily denial of service and operational disruption rather than data breach.

Detection Guidance

Detection should focus on anomalous resource consumption, request-rate spikes from low-privileged or single-source clients, JVM heap/GC pressure, and circuit-breaker or out-of-memory events. Because the exact triggering request is not specified in the available intelligence, rules below are behavioral and heuristic and must be tuned to the environment.

Sigma Rule

title: Elasticsearch Excessive Resource Consumption Denial of Service Attempt
id: 7a3c9e21-4f8b-4d2e-9c1a-93b0c6e5d441
status: experimental
description: Detects excessive allocation / resource exhaustion activity against Elasticsearch consistent with CVE-2026-94398 (CWE-400, CAPEC-130)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94398
author: valtersit.com
logsource:
  product: elasticsearch
  service: server
detection:
  selection_oom:
    message|contains:
      - "OutOfMemoryError"
      - "Java heap space"
      - "circuit_breaking_exception"
      - "Data too large"
  selection_fatal:
    log.level: FATAL
  selection_gc:
    message|contains:
      - "overhead of GC"
      - "too many open files"
  condition: selection_oom or selection_fatal or selection_gc
falsepositives:
  - Legitimate heavy aggregation or reindex workloads
  - Insufficiently provisioned clusters under normal load
level: high

YARA Rule

rule CVE_2026_94398_Elasticsearch_Resource_Exhaustion
{
    meta:
        description = "Detects log/artifact indicators of uncontrolled resource consumption (CWE-400) in Elasticsearch related to CVE-2026-94398"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94398"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "high"

    strings:
        $oom   = "OutOfMemoryError" ascii nocase
        $heap  = "Java heap space" ascii nocase
        $cb    = "circuit_breaking_exception" ascii nocase
        $dtl   = "Data too large" ascii nocase
        $gc    = "overhead of GC" ascii nocase

    condition:
        (2 of ($oom, $heap)) or ($cb and $dtl) or ($oom and $gc)
}

Suricata IDS Rule

alert http any any -> any 9200 (msg:"CVE-2026-94398 Elasticsearch Resource Exhaustion Attempt (CWE-400)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"_search"; threshold:type both, track by_src, count 200, seconds 10; classtype:attempted-dos; sid:202694398; rev:1; metadata:reference nvd,cve CVE-2026-94398;)

Note: The _search URI is a common Elasticsearch entry point used for request-rate thresholding; the rule is a behavioral DoS heuristic and is not derived from a confirmed triggering endpoint, which the available intelligence does not specify.

Elastic Detection

sequence by source.ip with maxspan=30s
  [ any where event.category == "web" and
      process.name == "java" and
      http.request.method == "POST" and
      url.path : "*_search*" ]
  [ any where event.category == "web" and
      process.name == "java" and
      http.request.method == "POST" and
      url.path : "*_search*" ]

Correlate with host metrics where available:

metrics where jvm.memory.heap.used.pct >= 0.95 or
               elasticsearch.node.stats.jvm.gc.collectors.young.collection_time.ms > 5000

Splunk SPL Query

index=elasticsearch OR index=es_logs (message="*OutOfMemoryError*" OR message="*Java heap space*" OR message="*circuit_breaking_exception*" OR message="*Data too large*")
| stats count min(_time) as firstTime max(_time) as lastTime by host, message
| where count > 3
| convert ctime(firstTime) ctime(lastTime)

Rate-based request anomaly detection:

index=web sourcetype=elasticsearch_access
| bucket _time span=10s
| stats count as reqs by _time, src_ip, uri_path
| where reqs > 200 AND match(uri_path, "_search|_bulk|_msearch")
| sort - reqs

Wazuh OSSEC Rule

<group name="elasticsearch,cve-2026-94398,">
  <rule id="100943" level="12">
    <decoded_as>json</decoded_as>
    <field name="message">OutOfMemoryError|Java heap space</field>
    <description>CVE-2026-94398: Elasticsearch JVM out-of-memory condition (possible CWE-400 resource exhaustion)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
  <rule id="100944" level="10">
    <decoded_as>json</decoded_as>
    <field name="message">circuit_breaking_exception|Data too large</field>
    <description>CVE-2026-94398: Elasticsearch circuit breaker tripped (possible resource exhaustion attempt)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, fixed version, or workaround is currently available for CVE-2026-94398.

1. Immediate mitigations
   • Restrict network exposure of the Elasticsearch HTTP transport to trusted networks; never expose clusters directly to the internet.
   • Enforce least-privilege RBAC and audit low-privileged accounts; reduce the population of accounts capable of triggering resource-intensive operations, since the vector requires only low privileges (PR:L).
   • Apply client-side and proxy-level rate limiting and request-size caps in front of Elasticsearch.
   • Tune and verify circuit breakers (parent, fielddata, request, in-flight) and set conservative JVM heap sizing to fail fast under allocation pressure.
   • Enable and monitor JVM heap, GC, thread-pool rejection, and circuit-breaker metrics; configure automated alerts.
   • Segment clusters so a single node's exhaustion cannot degrade unrelated workloads.
2. Patch/upgrade steps
   • Monitor the Elastic security advisories and the NVD entry for CVE-2026-94398 for an official fix.
   • Once a fixed version is published, stage the upgrade in a non-production cluster, validate, then roll out with a rolling restart to preserve availability.
   • Until a patch exists, treat this as an open availability risk and rely on compensating controls listed above.
3. Long-term hardening
   • Adopt a documented software bill of materials (SBOM) and continuous vulnerability monitoring for the Elasticsearch stack and its plugins.
   • Harden authentication (disable anonymous access, rotate API keys, enforce strong credentials).
   • Implement resource quotas, shard and query limits, and capacity planning to absorb abnormal load.
   • Maintain tested backup, snapshot, and disaster-recovery procedures to reduce outage duration.

References

• NVD — CVE-2026-94398: https://nvd.nist.gov/vuln/detail/CVE-2026-94398
• CWE-400: Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• CAPEC-130: Excessive Allocation: https://capec.mitre.org/data/definitions/130.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• Elastic Security Advisories: https://www.elastic.co/community/security

Threat actor / in-the-wild evidence: None. CVE-2026-94398 is not listed in CISA KEV, has no known public proof-of-concept, no Nuclei template, and no exploit code as of this report. EPSS has not yet assigned a score.