CVE-2026-82294

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Published

Sep 24, 2026, 10:00:00 PM UTC

Updated

Sep 26, 2026, 9:16:55 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.24% · Oct 25, 2026

A flaw was found in Elasticsearch. An authenticated remote attacker can exploit this vulnerability to trigger excessive resource allocation, leading to a Denial of Service (DoS). By sending requests that consume disproportionate system resources, an attacker can exhaust system capacity and cause the service to become unresponsive. elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service This vulnerability is rated as Moderate because exploitation requires authenticated network access and solely results in a denial of service without compromising system confidentiality or integrity. In Red Hat environments, including Red Hat Quay and Red Hat OpenShift AI, Elasticsearch functions as an internal data store and search backend rather than an openly exposed endpoint. An attacker with valid credentials must supply specialized queries that exhaust available node memory or compute capacity, confining the disruption to cluster availability without enabling remote code execution. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.