CVE-2026-115715
Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of the analysis-phonetic plugin. An authenticated user with permission to write documents to or run searches against an index that uses an affected encoder can cause an Elasticsearch node to exhaust its heap memory. The node can become unresponsive or terminate.
| CWE | CWE-770 |
| Vendor | elastic |
| Product | elasticsearch |
| Ecosystems | |
| Industries | Technology |
| Published | Nov 3, 2026 |
| Last Updated | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for elastic elasticsearch
Be the first to know when new medium vulnerabilities affecting elastic elasticsearch are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
Elastic / Elasticsearch
8.0.0 ≤ 8.19.23 9.0.0 ≤ 9.4.8 9.5.0 ≤ 9.5.5