PT-2026-54864 · Elastic · Elasticsearch

Kruskall · Published 2026-07-01 · Updated 2026-07-06 · CVE-2026-56149

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Elasticsearch (affected versions not specified)

Description An issue exists where the allocation of resources lacks limits or throttling. A user with elevated privileges can submit a specially crafted machine learning request that triggers excessive memory consumption, potentially leading to a denial of service and rendering the affected node unavailable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-ELASTICSEARCH-2026-56149

CVE-2026-56149

Affected Products

Elasticsearch

References · 4

• https://discuss.elastic.co/t/elasticsearch-8-19-17-9-3-6-9-4-3-security-update-esa-2026-43 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56149 · Security Note
• https://osv.dev/vulnerability/BIT-elasticsearch-2026-56149 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2072406645083181547 · Twitter Post