CVE-2026-56145

{
  "id": "CVE-2026-56145",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T20:17:02.500",
  "lastModified": "2026-10-24T19:10:00.127",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user with permission to execute EQL sequence queries against an index they control can send a specially crafted query that triggers excessive memory consumption, causing the Elasticsearch node to crash."
    },
    {
      "lang": "es",
      "value": "El Consumo Incontrolado de Recursos (CWE-400) en Elasticsearch puede conducir a una denegación de servicio a través de Asignación Excesiva (CAPEC-130). Un usuario autenticado con bajos privilegios y con permiso para ejecutar consultas de secuencia EQL contra un índice que controla puede enviar una consulta especialmente diseñada que desencadena un consumo excesivo de memoria, provocando que el nodo de Elasticsearch se bloquee."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Elastic",
          "product": "Elasticsearch",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "9.4.0",
              "lessThanOrEqual": "9.4.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.0.0",
              "lessThanOrEqual": "8.19.17",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "9.0.0",
              "lessThanOrEqual": "9.3.6",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T18:13:57.687829Z",
          "id": "CVE-2026-56145",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.0.0",
              "versionEndExcluding": "8.19.18",
              "matchCriteriaId": "691E83C2-9C1B-40CF-AD6B-3C036D928E8C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "9.0.0",
              "versionEndExcluding": "9.3.7",
              "matchCriteriaId": "7B223737-B8B8-4D19-80D2-060A06F46AC0"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "9.4.0",
              "versionEndExcluding": "9.4.4",
              "matchCriteriaId": "54F14824-0093-4DA8-95AD-ED8F481722FC"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-18-9-3-7-9-4-4-security-update-esa-2026-57/388556",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}