Description

Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to attempt an excessively large allocation. The resulting memory exhaustion raises a fatal error that terminates the Elasticsearch node process, causing a denial of service for the affected node and degrading cluster health. The defect is not volumetric, so a single request is sufficient regardless of the heap size configured on the target node.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:28.497Z",
  "pubdate": "2026-08-13T20:17:28.497Z",
  "executiveSummary": "Elasticsearch contains a critical memory exhaustion vulnerability that allows an authenticated attacker to trigger a denial of service (DoS) against targeted cluster nodes.\nThe vulnerability stems from the application failing to validate a user-supplied size value before using it to allocate memory for an internal data structure.\nBy submitting a single, specially crafted request to a vulnerable product API endpoint, an attacker with basic read privileges can force the Elasticsearch node to attempt an excessively large memory allocation.\nThis operation causes a fatal memory exhaustion error that abruptly terminates the Elasticsearch node process, degrading overall cluster health.\nThe attack is non-volumetric and effective regardless of the target node's configured heap size, meaning a single low-bandwidth request is sufficient to achieve complete service interruption.\nExploitation requires authentication with read privileges, limiting unauthenticated exposure while presenting significant risk from compromised or malicious internal accounts.",
  "technicalDetails": "The root cause of the vulnerability resides in insufficient input validation within the Elasticsearch API endpoint handling user-supplied size parameters.\nSpecifically, when an authenticated user submits a request containing a crafted size value, the vulnerable component utilizes this value directly to reserve memory for an internal data structure without checking its bounds or feasibility against available resources.\nThe attack vector involves network exposure to the Elasticsearch product API endpoints, requiring the attacker to hold at least read privileges within the cluster.\nThe attack flow proceeds as follows: First, the authenticated attacker crafts a small HTTP or protocol request containing a maliciously large size parameter. Second, the attacker transmits this request to the vulnerable API endpoint on the target Elasticsearch node. Third, the internal logic reads the unvalidated size value and attempts to reserve a disproportionately massive block of memory for an internal data structure. Fourth, this allocation request overwhelms the Java Virtual Machine (JVM) heap or native memory limits, triggering a fatal OutOfMemoryError (OOM) or similar critical memory exception. Finally, the exception forces the runtime environment to terminate the Elasticsearch node process immediately, resulting in an ungraceful crash.\nThe impact of payload execution is localized denial of service on the targeted node and subsequent degradation of cluster health and availability, as shard allocation and cluster state management are disrupted.\nThe defect is distinctively non-volumetric; it does not rely on a high volume of requests or network saturation, and the success of the attack is agnostic to the configured heap size of the target node."
}