Description

Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user holding only read privileges on a single searchable index can submit one small search request that causes the node to reserve an excessively large internal data structure. The allocation occurs before the existing highlighting safety limits are evaluated, so memory exhaustion raises a fatal error that terminates the Elasticsearch node process. This results in a denial of service for the affected node and degrades cluster routing and health. The defect is not volumetric and does not depend on the size of the indexed data, so a single request is sufficient.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:24.427Z",
  "pubdate": "2026-08-13T20:17:24.427Z",
  "executiveSummary": "This vulnerability involves an improper resource allocation flaw within the search highlighting functionality of Elasticsearch.\nThe root issue stems from the application failing to enforce an upper bound on a user-supplied count parameter accepted during search highlighting operations, combined with a lack of circuit breaker accounting for the resulting memory allocation.\nAn authenticated attacker holding only read privileges on a single searchable index can exploit this flaw by submitting a single, specially crafted search request containing an excessively large count value.\nBecause the memory allocation occurs prior to the evaluation of existing highlighting safety limits, the node attempts to reserve a massively oversized internal data structure.\nThis triggers an unhandled memory exhaustion condition resulting in a fatal error that abruptly terminates the Elasticsearch node process, causing a denial of service for the affected node and negatively impacting overall cluster routing and health.\nThe exploitation vector is non-volumetric, does not depend on the volume of indexed data, and requires minimal attacker capabilities, specifically authenticated access with read privileges to any searchable index.",
  "technicalDetails": "The vulnerability resides in the search highlighting subsystem of Elasticsearch, specifically within the handling of user-supplied count parameters that dictate internal data structure allocations.\nThe root cause is twofold: the absence of validation bounds on the user-supplied count value and the omission of circuit breaker tracking for memory allocated by this specific request path.\nWhen a user submits a search request, the search highlighting component processes the provided count parameter and attempts to allocate memory for internal data structures based entirely on this input.\nThis allocation happens strictly before the evaluation of any existing safety limits or thresholds designed to restrict highlighting resource consumption.\nAs a result, a low-privileged attacker possessing only read access to a single searchable index can supply an extremely large integer for the count parameter within a single HTTP search request.\nUpon processing, the Elasticsearch node attempts to reserve a disproportionately large block of memory to satisfy the requested data structure size.\nThis bypasses normal memory safeguards and circuit breakers that would typically monitor and halt excessive resource consumption.\nThe resulting memory exhaustion immediately triggers a fatal error, forcing the Java Virtual Machine or the operating system to terminate the Elasticsearch node process entirely.\nThis sudden termination results in a localized denial of service, forcing the cluster to re-route shards, destabilizing cluster health, and potentially cascading failures if multiple nodes are targeted concurrently.\nThe attack requires authentication and read privileges on at least one searchable index, but does not rely on complex payload crafting, pre-existing indexed data volumes, or high-bandwidth traffic generation."
}