CVE-2026-56145 in Elasticsearch
Summary
by MITRE • 07/21/2026
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL sequence queries against an index they control can send a specially crafted query that triggers excessive memory consumption, causing the Elasticsearch node to crash.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/21/2026
This vulnerability represents a critical resource exhaustion flaw in the elasticsearch search and analytics engine that operates under the common weakness enumeration CWE-400 category for uncontrolled resource consumption. The specific exploit path involves a low-privileged authenticated user who possesses permissions to execute EQL (Elastic Query Language) sequence queries against indexes they control, creating a pathway for malicious actors to consume excessive system resources through carefully crafted query structures. The attack vector leverages the Excessive Allocation pattern described in CAPEC-130, where an attacker manipulates the resource allocation mechanisms within elasticsearch to trigger memory exhaustion conditions that ultimately result in node crashes and complete service disruption.
The technical implementation of this vulnerability exploits how elasticsearch processes EQL sequence queries by allowing attackers to construct queries that cause the system to allocate memory resources beyond normal operational limits. When a user with appropriate permissions submits a maliciously crafted query, the elasticsearch engine processes this request through its query parsing and execution pipeline, where the resource allocation algorithms fail to properly constrain memory usage for complex sequence operations. This leads to a gradual or sudden increase in memory consumption that exceeds the available system resources, causing the node to either crash completely or become unresponsive due to insufficient memory allocation for other critical processes.
From an operational impact perspective, this vulnerability creates severe availability risks for elasticsearch deployments where multiple users have access to execute EQL queries against their own indexes. The low privilege requirement means that even users with minimal access rights can potentially disrupt service availability, making this particularly dangerous in multi-tenant environments or shared systems where proper access controls may not be sufficiently enforced. The denial of service condition affects not just the specific node experiencing resource exhaustion but can also impact cluster stability and overall system performance, especially when multiple nodes are affected simultaneously through coordinated attacks.
Organizations should implement immediate mitigations including restricting EQL query execution permissions to only trusted administrative users, implementing resource quotas and limits for query processing operations, and deploying monitoring systems that can detect unusual memory consumption patterns. The vulnerability aligns with ATT&CK technique T1499.004 for network denial of service attacks, where attackers leverage application-level vulnerabilities to exhaust system resources. Security teams should also consider implementing query validation mechanisms that analyze EQL sequences for potentially dangerous resource allocation patterns and establish proper access control measures through elasticsearch's built-in security features to prevent unauthorized users from executing queries that could trigger this behavior while maintaining legitimate operational functionality.