CVE catalog

CVE-2026-49090

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk request tha

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.42% · Oct 25, 2026

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk request that causes sustained high CPU consumption, which can render the affected node unable to process requests.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpeelasticsearchNot reported7.17.24fixed
CpeelasticsearchNot reported8.15.0fixed
Ubuntuelasticsearch16.041.6.2+dfsg-1vulnerable
Ubuntuelasticsearch16.041.7.3+dfsg-1vulnerable
Ubuntuelasticsearch16.041.7.3+dfsg-2vulnerable
Ubuntuelasticsearch16.041.7.3+dfsg-3vulnerable
CpeelasticsearchNot reported8.15.0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpeelasticsearchcpeNot reported7.17.24Not reportedNot reportedNot reported
CpeelasticsearchcpeNot reported8.15.0Not reportedNot reportedNot reported
CpeelasticsearchcpeNot reported8.15.0Not reportedNVD-CVE-2026-49090Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]