CVE-2026-82294 describes an uncontrolled resource consumption vulnerability in Elastic Elasticsearch, categorized under CWE-400. The issue can lead to denial of service conditions by causing excessive allocation of system resources (CAPEC-130). Affected versions include Elasticsearch releases from 8.0.0 up to and including 8.19.20, 9.0.0 up to and including 9.4.5, and 9.5.0 up to and including 9.5.2. The vulnerability has a CVSS 3.1 score of 6.5 with attack vector network, low attack complexity, requiring privileges, no user interaction, unchanged scope, and impacts availability only. There is no vendor advisory or patch information provided, and no known exploitation in the wild has been reported.

Successful exploitation of this vulnerability can cause denial of service by exhausting system resources, impacting the availability of Elasticsearch services. There is no reported impact on confidentiality or integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, monitor Elastic's advisories for updates. In the meantime, consider limiting resource allocation or applying resource usage controls as a temporary mitigation if feasible.