Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-94396 EUVD-2026-87800GHSA-rrx7-wqpq-27hx

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Published Sep 26, 2026 · Updated Sep 26, 2026 · Assigned by elastic

Vendor: Elastic Product: Elasticsearch Package: ruby3.2-elasticsearch Package: ruby3.3-elasticsearch Package: ruby3.4-elasticsearch Package: ruby4.0-elasticsearch Ecosystem: Wolfi

Description

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

Affected products

VendorProductAffectedFixed
Elastic Elasticsearch 9.2.0 – ≤ 9.4.6, 9.5.0 – ≤ 9.5.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling ruby3.2-elasticsearch +3 No fix yet —

Advisories 1

References