CVE-2026-49090

EUVD-2026-41100
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk request that causes sustained high CPU consumption, which can render the affected node unable to process requests.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 16.73%
Affected Products (NVD)
VendorProductVersion
elasticelasticsearch
7.0.0 ≤
𝑥
< 7.17.24
elasticelasticsearch
8.0.0 ≤
𝑥
< 8.15.0
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
elasticsearch
jammy
dne
noble
dne
questing
dne
resolute
dne
Common Weakness Enumeration
References
https://discuss.elastic.co/t/elasticsearch-7-17-24-8-15-0-security-update-esa-2026-52