Medium severity6.5NVD Advisory· Published Jul 21, 2026· Updated Aug 7, 2026

CVE-2026-56145

Description

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL sequence queries against an index they control can send a specially crafted query that triggers excessive memory consumption, causing the Elasticsearch node to crash.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Elastic/Elasticsearch2 versions
cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*range: >=8.0.0,<8.19.18
- (no CPE)
Fantastic ElasticSearch/Fantastic ElasticSearchllm-fuzzy
osv-coords9 versions
pkg:apk/chainguard/ruby3.2-elasticsearch pkg:apk/chainguard/ruby3.3-elasticsearch pkg:apk/chainguard/ruby3.4-elasticsearch pkg:apk/chainguard/ruby4.0-elasticsearch pkg:apk/wolfi/ruby3.2-elasticsearch pkg:apk/wolfi/ruby3.3-elasticsearch pkg:apk/wolfi/ruby3.4-elasticsearch pkg:apk/wolfi/ruby4.0-elasticsearch pkg:bitnami/elasticsearch
< 9.5.0-r0+ 8 more
- (no CPE)range: < 9.5.0-r0
- (no CPE)range: < 9.5.0-r0
- (no CPE)range: < 9.5.0-r1
- (no CPE)range: < 9.5.0-r0
- (no CPE)range: < 9.5.0-r0
- (no CPE)range: < 9.5.0-r0
- (no CPE)range: < 9.5.0-r1
- (no CPE)range: < 9.5.0-r0
- (no CPE)range: >= 8.0.0, < 8.19.18

Patches

Vulnerability mechanics

References

discuss.elastic.co/t/elasticsearch-8-19-18-9-3-7-9-4-4-security-update-esa-2026-57/388556nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000