CVE-2026-94399

Executive Summary

CVE-2026-94399 is an uncontrolled resource consumption vulnerability (CWE-400) affecting Elasticsearch. A remote, authenticated attacker with low privileges can trigger excessive memory or resource allocation (CAPEC-130), degrading or denying service availability to legitimate users. The vulnerability carries a CVSS v3.1 base score of 6.5 and remains unpatched with no vendor fix, public proof-of-concept, exploit code, or Nuclei template currently available.

Technical Analysis

The NVD description classifies this vulnerability as CWE-400: Uncontrolled Resource Consumption, with the resulting impact mapped to CAPEC-130: Excessive Allocation. Elasticsearch is a distributed, REST-accessible search and analytics engine. This vulnerability class occurs when an application accepts attacker-influenced input that drives the allocation of memory, threads, file descriptors, or other finite resources without an enforced upper bound or adequate backpressure. In the Elasticsearch context, resource-consuming operations are reached over the network API surface, which is consistent with the CVSS network attack vector (AV:N).

The CVSS v3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) indicates the following: the flaw is reachable over the network; exploitation requires no special conditions beyond those normally present (AC:L); the attacker must hold some level of valid credentials or low-privilege access (PR:L); no user interaction is required (UI:N); the impact is scoped to the vulnerable component (S:U); there is no confidentiality or integrity impact (C:N, I:N); and there is a high availability impact (A:H). The PR:L designation is significant — it means the resource-exhaustion path is gated behind authentication, narrowing the attacker population to users, service accounts, or compromised credentials with legitimate but limited access.

The specific request, endpoint, parameter, or code path that drives the excessive allocation is not disclosed in the provided data. No function names, API endpoints, parameter names, or file paths are described in the NVD entry or CNA title. Accordingly, this report describes the attack strictly at the vulnerability-class level and does not fabricate the precise trigger mechanism. Consumers should monitor the vendor's advisory channels for the exact affected component (e.g., a specific query parser, aggregation, snapshot, or search operation) and the corresponding fixed release.

The mechanism by which uncontrolled allocation produces denial of service is well understood for JVM-based, memory-intensive services such as Elasticsearch: an unbounded allocation consumes heap, triggers aggressive garbage collection, and can escalate to OutOfMemoryError conditions that destabilize the node, force failover, or take down cluster services. Because Elasticsearch nodes operate as a cluster, saturation of one node can propagate across the cluster through shard reallocation, replica promotion, and increased load on surviving nodes, magnifying the blast radius beyond the single vulnerable instance.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred from the vulnerability class (CWE-400, CAPEC-130) and the CVSS metadata. No specific function names, endpoints, or parameters are invented.

1. Reconnaissance / target identification. The attacker identifies an exposed Elasticsearch service. Although the CVSS vector requires low privileges (PR:L), reconnaissance still targets network-reachable nodes. Default Elasticsearch REST access is commonly observed on TCP port 9200, and operators frequently expose cluster APIs unintentionally. Shodan queries such as product:"Elasticsearch" or port:9200 assist in identifying internet-exposed deployments.

2. Access prerequisite. Because the vector specifies PR:L, the attacker must possess valid low-privilege credentials or a compromised token. This can be obtained through credential theft, weak or default credentials, misconfigured role mappings, or lateral movement from an already-compromised account within the environment.

3. Triggering the flaw class. Using the authenticated session, the attacker issues operations that cause the service to allocate resources without an enforced bound. At the vulnerability-class level, this corresponds to repeatedly or cumulatively invoking a resource-consumption path (e.g., memory- or work-intensive requests) whose allocation is not adequately limited or rate-limited. The exact operation is undocumented; exploitation requires identifying whichever authenticated API path in the affected build drives the uncontrolled allocation described by CAPEC-130.

4. Post-exploitation impact. With no confidentiality or integrity impact, the objective is purely availability. Sustained allocation pressure degrades response times, increases GC overhead, and may culminate in node instability or crash. In clustered deployments this can cascade through shard relocation and replica promotion, producing cluster-wide service degradation or outage. Repeated triggering can sustain an indefinite denial-of-service condition as long as the attacker retains low-privilege access.

Impact Assessment

The business impact is availability-centric. CVSS v3.1 assigns a base score of 6.5 (Medium) with subscores C:N/I:N/A:H — meaning the sole material impact is loss of availability. For organizations running Elasticsearch as a search, logging, observability, or SIEM backend, a successful denial of service can blind security monitoring, halt application search and analytics, and interrupt dependent business workflows. Because Elasticsearch frequently underpins detection pipelines, an availability outage may simultaneously degrade an organization's ability to detect other intrusions.

The blast radius scales with deployment topology. A single-node deployment suffers localized downtime; a clustered deployment risks cascade effects through shard reallocation and replica promotion, potentially extending the outage cluster-wide. The PR:L requirement limits the attacker population but does not eliminate risk — compromised low-privilege accounts, shared service credentials, and misconfigured role-based access control all satisfy the precondition. Unpatched status (0/4 patch confidence, no vendor fix) means impacted organizations have no remediation path other than the operational mitigations described below. No EPSS score is currently assigned, and the CVE is not listed in CISA KEV, so there is no confirmed evidence of active exploitation in the wild at the time of writing.

Detection Guidance

Sigma Rule

title: Potential Elasticsearch Resource Exhaustion Attempt (CVE-2026-94399)
id: 8f1c2a44-7b3d-4e21-9a55-3c9d1f0a6b21
status: experimental
description: Detects repeated high-volume authenticated Elasticsearch API calls that may indicate exploitation of an uncontrolled resource consumption flaw (CWE-400).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-94399
author: valtersit.com
date: 2026-01-01
logsource:
  product: elasticsearch
  service: audit
detection:
  selection:
    event.action|contains:
      - 'search'
      - 'index'
  timeframe: 5m
  condition: selection | count() by user.name, source.ip > 500
fields:
  - user.name
  - source.ip
  - event.action
falsepositives:
  - Legitimate bulk indexing or legitimate high-volume analytics workloads
level: medium
tags:
  - attack.t1499
  - cve.2026-94399

YARA Rule

rule CVE_2026_94399_Elasticsearch_Resource_Exhaustion_Artifact
{
    meta:
        description = "Detects log or memory-dump artifacts referencing uncontrolled resource consumption in Elasticsearch (CVE-2026-94399)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-94399"
        cve = "CVE-2026-94399"

    strings:
        $oom = "OutOfMemoryError" ascii nocase
        $es  = "Elasticsearch" ascii nocase
        $heap = "heap space" ascii nocase
        $alloc = "allocation" ascii nocase

    condition:
        uint32(0) == 0x464c457f or ( $es and $oom and ( $heap or $alloc ) )
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 9200 (msg:"CVE-2026-94399 Possible Elasticsearch Resource Exhaustion Attempt"; flow:established,to_server; content:"_search"; http_uri; nocase; threshold:type both, track by_src, count 300, seconds 60; classtype:attempted-dos; reference:cve,2026-94399; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-94399; sid:9024399; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ any where event.category == "database" and event.action == "search" ]
  [ any where event.category == "database" and event.action == "search" ]
  [ any where event.category == "database" and event.action == "search" ]

Splunk SPL Query

index=elasticsearch sourcetype=elasticsearch:audit
| search event.action IN ("search","index")
| bin _time span=1m
| stats count AS reqs values(event.action) AS actions BY user.name, source.ip, _time
| where reqs > 300
| table _time, user.name, source.ip, reqs, actions

Wazuh OSSEC Rule

<group name="elasticsearch,cve-2026-94399,">
  <rule id="100739" level="10" frequency="20" timeframe="60">
    <if_matched_sid>100738</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-94399 - Possible Elasticsearch resource exhaustion: excessive authenticated API requests causing uncontrolled allocation (CWE-400)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, advisory, or fixed version has been confirmed by tracked sources.

1. Immediate mitigations:

• Restrict network exposure of Elasticsearch ports (default 9200/9300) to trusted management networks and never to the public internet; enforce firewall allowlists and TLS.
• Enforce least-privilege role-based access control and eliminate shared or default credentials to raise the effective privilege barrier, since exploitation requires low-privilege (PR:L) authenticated access.
• Apply per-user and per-endpoint rate limiting or quota enforcement at the reverse proxy or API gateway to cap the resource consumption reachable by any single authenticated identity.
• Require authentication on all cluster APIs and audit authenticated activity (see Detection Guidance) to rapidly identify anomalous high-volume requests.
• Ensure adequate JVM heap headroom and monitor garbage collection and node resource metrics to detect early signs of allocation pressure.

2. Patch/upgrade steps:

• There is no confirmed fixed version. Monitor the Elastic vendor advisory channels and the NVD entry for CVE-2026-94399 and apply the vendor-provided fix as soon as it is published. Maintain a tested rollback procedure before upgrading production clusters.

3. Long-term hardening:

• Segment Elasticsearch clusters from general user networks and adopt zero-trust access for cluster APIs.
• Continuously monitor cluster resource metrics (heap, GC, thread pools, node health) and alert on abnormal trends.
• Establish a vulnerability management process that tracks unpatched CVEs and applies compensating controls until fixes land, and periodically review role mappings and credential hygiene.

References

• NVD — CVE-2026-94399: https://nvd.nist.gov/vuln/detail/CVE-2026-94399
• MITRE CWE-400 — Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• MITRE CAPEC-130 — Excessive Allocation: https://capec.mitre.org/data/definitions/130.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• Elastic Security Advisories (monitor for forthcoming CVE-2026-94399 advisory): https://www.elastic.co/community/security

No public proof-of-concept, exploit code, or Nuclei template is available. No exploit-in-the-wild evidence or associated threat actor campaign has been identified, and CVE-2026-94399 is not listed in CISA KEV at the time of writing.