CVE-2026-56143— Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
Quick assessment
Affected
Elastic Elasticsearch
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Elasticsearch 中的“无限制或无节流的资源分配”（CWE-770）可能导致通过“过度分配”（CAPEC-130）引发服务拒绝（DoS）。拥有提升权限的用户可以提交一个特制的请求，导致过大的内存消耗，从而使受影响的节点变得不可用。
Possible ATT&CK Techniques 1 AI
T1082 · System Information DiscoveryAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Elastic | Elasticsearch | 8.0.0≤ 8.19.19 |
affected |
9.0.0≤ 9.2.8 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-56143
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
Source: CVE Program / CVE List V5
Vulnerability Description
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a specially crafted request that causes excessive memory consumption, which may render the affected node unavailable.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Elastic | Elasticsearch | 8.0.0 ~ 8.19.19 | - |
|
II. Public POCs for CVE-2026-56143
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-56143
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-56143 (1)
Same Patch Batch · Elastic · 2026-09-01 · 20 CVEs total
| CVE-2026-72649 | 8.8 HIGH | Deserialization of Untrusted Data in Elasticsearch Leading to Remote Code Execution |
| CVE-2026-63137 | 8.3 HIGH | Incorrect Authorization in Kibana Leading to Privilege Escalation |
| CVE-2026-78592 | 7.3 HIGH | Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthori |
| CVE-2024-14047 | 7.2 HIGH | Improper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Ar |
| CVE-2026-78608 | 6.5 MEDIUM | Missing Authorization in Kibana Leading to Information Disclosure |
| CVE-2026-33465 | 6.5 MEDIUM | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Servic |
| CVE-2026-63138 | 6.5 MEDIUM | Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Infor |
| CVE-2026-72654 | 6.5 MEDIUM | Execution with Unnecessary Privileges in Kibana Leading to Information Disclosure |
| CVE-2026-72628 | 6.5 MEDIUM | Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service |
| CVE-2026-72652 | 6.5 MEDIUM | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Servic |
| CVE-2026-72644 | 6.5 MEDIUM | Uncaught Exception in Kibana Leading to Denial of Service |
| CVE-2026-72682 | 6.5 MEDIUM | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Servic |
| CVE-2026-78605 | 5.9 MEDIUM | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') in Elasticsearch L |
| CVE-2026-78607 | 5.4 MEDIUM | Missing Authorization in Elasticsearch Leading to Information Disclosure |
| CVE-2026-72641 | 5.4 MEDIUM | Incorrect Authorization in Kibana Leading to Unauthorized Modification of Data |
| CVE-2026-72633 | 4.3 MEDIUM | Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitorin |
| CVE-2026-78603 | 4.3 MEDIUM | Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Met |
| CVE-2026-78597 | 4.3 MEDIUM | Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation |
| CVE-2026-78606 | 4.2 MEDIUM | Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and De |
IV. Related Vulnerabilities
Same product: Elasticsearch
-
CVE-2026-78607
Missing Authorization in Elasticsearch Leading to Informatio -
CVE-2026-78605
Inconsistent Interpretation of HTTP Requests ('HTTP Request -
CVE-2026-72649
Deserialization of Untrusted Data in Elasticsearch Leading t -
CVE-2026-72636
Uncontrolled Recursion in Elasticsearch Wildcard Matching Le -
CVE-2026-72642
Use of Out-of-range Pointer Offset in the Elasticsearch Mach
Same vendor: Elastic
-
CVE-2026-63138
Improper Neutralization of Special Elements in Data Query Lo -
CVE-2026-78597
Missing Authorization in Kibana Entity Store Leading to Unau -
CVE-2026-78592
Improper Limitation of a Pathname to a Restricted Directory -
CVE-2026-78606
Incorrect Authorization in Kibana Leading to Unauthorized Di -
CVE-2026-78603
Missing Authorization in Kibana Leading to Unauthorized Disc
Same weakness: CWE-770
-
CVE-2026-72682
Allocation of Resources Without Limits or Throttling in Kiba -
CVE-2026-72652
Allocation of Resources Without Limits or Throttling in Kiba -
CVE-2026-33465
Allocation of Resources Without Limits or Throttling in Kiba -
CVE-2026-74835
inets,httpd: Memory Exhaustion via Unenforced max_body_size -
CVE-2026-83615
xmldom: Quadratic-memory consumption
V. Comments for CVE-2026-56143
No comments yet