CVE-2026-63263— Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
Possible ATT&CK Techniques 1AI
T1499 · Endpoint Denial of ServiceGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-63263
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
Source: NVD (National Vulnerability Database)
Vulnerability Description
Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource exhaustion persists beyond query completion, repeated requests can fully exhaust the available query worker resources, rendering ES|QL queries unavailable until the node is restarted.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Elastic | Elasticsearch | 9.4.0 ~ 9.4.3 | - |
II. Public POCs for CVE-2026-63263
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-63263
请登录查看更多情报信息。
Other References for CVE-2026-63263 (1)
Same Patch Batch · Elastic · 2026-07-21 · 19 CVEs total
| CVE-2026-56147 | 7.1 HIGH | Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Informa |
| CVE-2026-42397 | 6.5 MEDIUM | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Servic |
| CVE-2026-63260 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service |
| CVE-2026-63261 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service |
| CVE-2026-63144 | 6.5 MEDIUM | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service |
| CVE-2026-63140 | 6.5 MEDIUM | Reachable Assertion in Elasticsearch Leading to Denial of Service |
| CVE-2026-63136 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service |
| CVE-2026-63139 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service |
| CVE-2026-56145 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service |
| CVE-2026-63141 | 6.3 MEDIUM | Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management |
| CVE-2026-56146 | 5.4 MEDIUM | Improper Access Control in Kibana Leading to Unauthorized Data Modification and Informatio |
| CVE-2026-56144 | 5.3 MEDIUM | Incorrect Authorization in Elasticsearch Leading to Information Disclosure |
| CVE-2026-63142 | 5.0 MEDIUM | Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery |
| CVE-2026-63143 | 4.3 MEDIUM | Missing Authorization in Kibana Leading to Unauthorized Information Disclosure |
| CVE-2026-63259 | 4.3 MEDIUM | Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosu |
| CVE-2026-63145 | 4.3 MEDIUM | Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromi |
| CVE-2026-63262 | 4.3 MEDIUM | Missing Authorization in Kibana Leading to Information Disclosure |
| CVE-2026-49092 | 4.3 MEDIUM | Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Unauthorized Inf |
IV. Related Vulnerabilities
Same product: Elasticsearch
- CVE-2026-63144
Uncontrolled Recursion in Elasticsearch Leading to Denial of - CVE-2026-63140
Reachable Assertion in Elasticsearch Leading to Denial of Se - CVE-2026-63136
Uncontrolled Resource Consumption in Elasticsearch Leading t - CVE-2026-56145
Uncontrolled Resource Consumption in Elasticsearch Leading t - CVE-2026-56144
Incorrect Authorization in Elasticsearch Leading to Informat
Same vendor: Elastic
- CVE-2026-63262
Missing Authorization in Kibana Leading to Information Discl - CVE-2026-63261
Uncontrolled Resource Consumption in Kibana Leading to Denia - CVE-2026-63260
Uncontrolled Resource Consumption in Kibana Leading to Denia - CVE-2026-63259
Authorization Bypass Through User-Controlled Key in Kibana L - CVE-2026-63145
Incorrect Authorization in Kibana Leading to Machine Learnin
Same weakness: CWE-400
- CVE-2026-63261
Uncontrolled Resource Consumption in Kibana Leading to Denia - CVE-2026-63260
Uncontrolled Resource Consumption in Kibana Leading to Denia - CVE-2026-56819
Netty: HTTP/2 decompression leaks ByteBuf reference count wh - CVE-2026-56816
Netty: Memory Exhaustion via HTTP/3 Reserved Frame Types - CVE-2026-56745
Netty SpdyHttpDecoder: ByteBuf Reference Leak on RST_STREAM
V. Comments for CVE-2026-63263
No comments yet