Description

A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the scope of the existing memory accounting controls that were intended to constrain it. The resulting out-of-memory condition is fatal and terminates the affected node process, causing a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:29.100Z",
  "pubdate": "2026-08-13T20:17:29.100Z",
  "executiveSummary": "A denial of service vulnerability exists within Elasticsearch, specifically affecting systems processing crafted search requests. The vulnerability arises from an unconstrained memory allocation flaw occurring outside established memory accounting controls.\nAn authenticated attacker possessing only read privileges can exploit this flaw by submitting a specifically crafted user-supplied input within a small search request. Processing this input forces the internal component to allocate memory without an upper bound, immediately triggering a fatal out-of-memory condition.\nThe ultimate impact of this exploitation is the abrupt termination of the affected node process, resulting in a denial of service for the targeted Elasticsearch node.\nThe risk implications are significant for cluster stability, as a low-privileged user can crash cluster nodes remotely.\nExploitation requires valid authentication with at least read privileges and the ability to submit HTTP search requests containing the malicious payload.",
  "technicalDetails": "The root cause of the vulnerability lies in the failure of specific internal components to enforce proper memory boundaries and accounting controls during the processing of user-supplied search inputs.\nWhen a search request containing crafted input is evaluated, the internal component initiates memory allocation operations that bypass existing JVM or application-level memory limiters designed to prevent excessive consumption.\nThe attack flow proceeds as follows: First, the authenticated user with read privileges constructs a small, deceptively simple search request embedding the malicious payload. Second, the user transmits this request to the Elasticsearch cluster. Third, the receiving node parses the query and routes it to the vulnerable internal component. Fourth, the component processes the crafted input, triggering unbounded memory allocation outside the scope of memory accounting controls. Fifth, the host operating system or runtime environment exhausts available memory resources, inducing a fatal out-of-memory (OOM) condition. Finally, the Java Virtual Machine (JVM) or node process crashes and terminates abruptly, removing the node from the cluster and degrading overall service availability.\nThe vulnerable component is the internal search processing subsystem responsible for handling specific user-supplied query inputs.\nAuthentication is strictly required, though the privilege level is low, requiring only read access to the cluster or indices.\nPost-exploitation impact is limited to availability disruption; arbitrary code execution or data exfiltration is not facilitated by this specific memory exhaustion vector."
}