CVE-2026-94398

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Published

Sep 24, 2026, 10:00:00 PM UTC

Updated

Sep 26, 2026, 9:16:56 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.24% · Oct 25, 2026

A flaw was found in Elasticsearch. An authenticated remote attacker can exploit this vulnerability by submitting requests that trigger disproportionate memory allocation. This excessive resource consumption can lead to process termination and a Denial of Service (DoS) for the service. elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service Red Hat has evaluated this vulnerability as having a Moderate security impact because exploiting the flaw requires network access with valid user credentials to submit requests that trigger disproportionate memory allocation. The resulting failure is limited to availability degradation through service disruption or process termination, without compromising data confidentiality or system integrity. In Red Hat OpenShift AI environments, instances operate within managed cluster networks with restricted ingress, reducing exposure to unauthorized external actors. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.