Description

Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation allocates an unbounded amount of heap memory, exhausting the available heap on the receiving node and causing the node to become unavailable.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:25.747Z",
  "pubdate": "2026-08-13T20:17:25.747Z",
  "executiveSummary": "A vulnerability classified as Memory Allocation with Excessive Size Value (CWE-789) exists within the ES|QL query processing component of Elasticsearch. This security flaw enables a denial of service (DoS) condition via Excessive Allocation (CAPEC-130).\nThe impact of successful exploitation is the complete exhaustion of available heap memory on the receiving node, leading to service unavailability and node crashes.\nThe affected product is Elasticsearch, specifically within its ES|QL query execution engine. The risk implication is severe availability degradation across the cluster infrastructure.\nThe required attacker capabilities include authenticated access to the Elasticsearch cluster with the ability to submit ES|QL queries. Exploitation does not require elevated administrative privileges, provided the user can execute the malicious query payload against the vulnerable parsing and evaluation engine.",
  "technicalDetails": "The root cause of the vulnerability stems from improper handling of resource boundaries during memory allocation within the ES|QL query processing pipeline. When evaluating specially crafted ES|QL queries, the application allocates an unbounded amount of heap memory without enforcing strict upper limits or resource quotas on the resulting data structures.\nThe vulnerable component is the Elasticsearch ES|QL query processing and evaluation engine. The attack vector involves submitting a malicious ES|QL query payload designed to trigger massive, uncontrolled memory allocation upon evaluation.\nThe attack flow proceeds as follows: First, an authenticated user constructs a malicious ES|QL query containing parameters or operations that force the query engine to reserve an excessive size value in memory. Second, the user transmits this query to an Elasticsearch node over the network interface handling API requests. Third, the receiving node parses the query and initiates memory allocation for the evaluation phase. Fourth, because the application fails to validate the excessive size value against available heap thresholds, the query engine consumes the entirety of the available Java Virtual Machine (JVM) heap space.\nThis runaway memory consumption triggers out-of-memory (OOM) conditions, causing the node to become unresponsive or crash entirely. Consequently, this disrupts cluster operations and leads to a denial of service for other legitimate queries and cluster functions. Authentication is required to interact with the query interface, but no specialized privilege escalation is necessary beyond standard query execution rights."
}