CVE-2026-94396

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Published

Sep 24, 2026, 10:00:00 PM UTC

Updated

Sep 26, 2026, 9:16:56 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.24% · Oct 25, 2026

A flaw was found in Elasticsearch. This vulnerability allows an authenticated remote attacker to cause a Denial of Service (DoS) by triggering excessive resource allocation. By consuming uncontrolled system resources, an attacker can degrade performance or render the service unavailable. elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service This vulnerability is rated as Moderate impact because an authenticated attacker with network access can trigger excessive memory consumption, causing service unavailability without compromising host confidentiality or integrity. Within Red Hat environments, such as Red Hat OpenShift AI, the component operates in isolated internal service architectures rather than public-facing deployments. Therefore, the risk is contained to localized service disruption caused by authorized users or compromised internal services. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.