CVE-2026-94397

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Published

Sep 24, 2026, 10:00:00 PM UTC

Updated

Sep 26, 2026, 9:16:56 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.24% · Oct 25, 2026

A flaw was found in Elasticsearch. An authenticated remote attacker can exploit an uncontrolled resource consumption issue by submitting requests that trigger excessive allocation of system resources. This can exhaust available capacity, resulting in a Denial of Service (DoS) where the service becomes unresponsive or crashes. elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service This vulnerability is rated as Moderate impact because successful exploitation requires authenticated access and exclusively produces a denial of service, with no compromise to data confidentiality or integrity. Within Red Hat environments, such as Red Hat OpenShift AI, the affected service operates within internal cluster networks and is not directly accessible to untrusted users. Consequently, exploitation demands pre-existing authorization and network reachability, significantly limiting the threat surface. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.