---
id: CVE-2026-115715
title: >-
  Allocation of Resources Without Limits or Throttling in Elasticsearch Leading
  to Denial of Service
summary: >-
  Allocation of Resources Without Limits or Throttling (CWE-770) in
  Elasticsearch can lead to denial of service via a specially crafted input
  value that is processed by an affected phonetic encoder of the
  analysis-phonetic plugin. An authe…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-770
vendor: Elastic
product: Elasticsearch
affected:
  - Elasticsearch >= 8.0.0 <= 8.19.23
  - Elasticsearch >= 9.0.0 <= 9.4.8
  - Elasticsearch >= 9.5.0 <= 9.5.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-03T17:29:17.130239Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T17:29:46.551Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115715'
references:
  - url: >-
      https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-235/391372
tags:
  - cve.org
epss: 0.00321
epssPercentile: 0.25263
ingestedAt: '2026-11-05T20:33:06.322Z'
---

## Overview

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of the analysis-phonetic plugin. An authenticated user with permission to write documents to or run searches against an index that uses an affected encoder can cause an Elasticsearch node to exhaust its heap memory. The node can become unresponsive or terminate.

## Affected

- `Elasticsearch >= 8.0.0 <= 8.19.23`
- `Elasticsearch >= 9.0.0 <= 9.4.8`
- `Elasticsearch >= 9.5.0 <= 9.5.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.