CVE-2026-56143: CWE-770 Allocation of Resources Without Limits or Throttling in Elastic Elasticsearch

This vulnerability (CWE-770) in Elasticsearch involves allocation of resources without limits or throttling, allowing an attacker with elevated privileges to submit crafted requests that cause excessive memory consumption. This excessive allocation can render the affected Elasticsearch node unavailable, resulting in a denial of service condition. The vulnerability affects versions 8.0.0 and 9.0.0 of Elasticsearch. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact. There is no vendor advisory or patch available at this time.

An attacker with elevated privileges can exploit this vulnerability to cause excessive memory consumption on an Elasticsearch node, potentially rendering the node unavailable and causing denial of service. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict elevated privileges to trusted users only and monitor resource usage to detect potential abuse. Avoid exposing Elasticsearch nodes to untrusted networks or users with elevated privileges.