CVE-2026-94399

[Catálogo de CVE]

A flaw was found in Elasticsearch. An authenticated remote attacker can exploit this vulnerability by submitting requests that trigger excessive resource allocation, leading to system exhaustion. This flaw can result in a Denial of Service (DoS), rendering the service unresponsive to legitimate users. elasticsearch: Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service This vulnerability is rated as Moderate impact because an authenticated attacker with network reachability is required to induce service exhaustion, while data confidentiality and system integrity remain completely unaffected. Within Red Hat OpenShift AI, the affected Elasticsearch functionality is deployed internally within cluster services, which prevents unauthenticated remote exploitation. Furthermore, container images such as Red Hat Quay do not incorporate the vulnerable code paths and are not impacted. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Gravidade

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Published

Sep 24, 2026, 10:00:00 PM UTC

Updated

Sep 26, 2026, 9:16:56 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.24% · Oct 27, 2026

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "elasticsearch",
      "ranges": [
        {
          "fixed": "9.5.4",
          "introduced": "9.5.0",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "provider_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-94399",
      "fixed_version": "9.5.4",
      "provider_source": "nvd",
      "provider_record_id": "NVD-CVE-2026-94399",
      "provider_updated_at": "2026-09-29T20:15:11.523"
    }
  ]
}