CVE-2026-63136

{
  "id": "CVE-2026-63136",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T21:16:52.850",
  "lastModified": "2026-10-24T19:10:00.127",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A user with search privileges can submit a specially crafted search request that causes a data node to exhaust available heap memory, resulting in node unavailability and cluster degradation. An attacker could leverage this vulnerability to cause cluster downtime requiring manual intervention to restore service."
    },
    {
      "lang": "es",
      "value": "El Consumo de Recursos No Controlado (CWE-400) en Elasticsearch puede conducir a una denegación de servicio a través de la Asignación Excesiva (CAPEC-130). Un usuario con privilegios de búsqueda puede enviar una solicitud de búsqueda especialmente diseñada que provoca que un nodo de datos agote la memoria heap disponible, lo que resulta en la indisponibilidad del nodo y la degradación del clúster. Un atacante podría aprovechar esta vulnerabilidad para causar tiempo de inactividad del clúster que requiere intervención manual para restaurar el servicio."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Elastic",
          "product": "Elasticsearch",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "8.0.0",
              "lessThanOrEqual": "8.19.14",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "9.3.0",
              "lessThanOrEqual": "9.3.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "9.0.0",
              "lessThanOrEqual": "9.2.8",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T19:31:50.834030Z",
          "id": "CVE-2026-63136",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.0.0",
              "versionEndExcluding": "8.19.15",
              "matchCriteriaId": "3A0AD9E6-045D-466C-AC15-33E38E06E7D4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "9.0.0",
              "versionEndExcluding": "9.2.9",
              "matchCriteriaId": "BF20189B-F2C1-4D65-A484-3BE8B7572F05"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "9.3.0",
              "versionEndExcluding": "9.3.4",
              "matchCriteriaId": "DFD9CD8D-4075-4FC6-9DFF-3C3116BAA08C"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-15-9-2-9-9-3-4-security-update-esa-2026-60/388559",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}