CVE-2026-63263

Name of the Vulnerable Software and Affected Versions Elasticsearch (affected versions not specified)

Description Uncontrolled Resource Consumption in the ES|QL engine can lead to a denial of service through Exponential Data Expansion, a technique where a small input causes a disproportionately large amount of data to be processed. An authenticated user can submit a specially crafted query that triggers exponential CPU consumption during evaluation. Since this resource exhaustion continues after the query finishes, repeated requests can deplete all available query worker resources, making ES|QL queries unavailable until the node is restarted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.