CVE-2026-63136
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Jul 21, 2026
Vendor
unknown
Description
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage this vulnerability to cause cluster downtime requiring manual intervention to restore service.