Medium severity6.5NVD Advisory· Published Jul 22, 2026· Updated Aug 3, 2026
CVE-2026-63263
CVE-2026-63263
Description
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource exhaustion persists beyond query completion, repeated requests can fully exhaust the available query worker resources, rendering ES|QL queries unavailable until the node is restarted.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
12cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*range: >=8.0.0,<8.19.19
- (no CPE)
- osv-coords9 versionspkg:apk/wolfi/ruby3.4-elasticsearchpkg:apk/chainguard/ruby3.2-elasticsearchpkg:apk/chainguard/ruby3.3-elasticsearchpkg:apk/chainguard/ruby4.0-elasticsearchpkg:apk/wolfi/ruby4.0-elasticsearchpkg:bitnami/elasticsearchpkg:apk/chainguard/ruby3.4-elasticsearchpkg:apk/wolfi/ruby3.2-elasticsearchpkg:apk/wolfi/ruby3.3-elasticsearch
< 9.5.0-r1+ 8 more
- (no CPE)range: < 9.5.0-r1
- (no CPE)range: < 9.5.0-r0
- (no CPE)range: < 9.5.0-r0
- (no CPE)range: < 9.5.0-r0
- (no CPE)range: < 9.5.0-r0
- (no CPE)range: >= 8.0.0, < 8.19.19
- (no CPE)range: < 9.5.0-r1
- (no CPE)range: < 9.5.0-r0
- (no CPE)range: < 9.5.0-r0
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.