Description

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the identifier drives an allocation that is neither capped nor accounted for by the available memory-usage controls. The resulting out-of-memory condition is fatal and terminates the affected node process, resulting in a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:29.460Z",
  "pubdate": "2026-08-13T20:17:29.460Z",
  "executiveSummary": "A denial of service vulnerability exists within Elasticsearch, specifically involving insecure deserialization and unconstrained memory allocation triggered by forged opaque identifiers.\nThe flaw allows a low-privileged authenticated user to submit a maliciously crafted request containing a forged opaque identifier to the cluster.\nUpon receipt, Elasticsearch decodes and deserializes the identifier prior to cryptographically or logically verifying its legitimacy and issuance origin.\nAn internal size value encapsulated within the payload directly drives an unconstrained memory allocation that bypasses existing memory-usage controls and circuit breakers.\nThis unchecked allocation immediately precipitates a fatal out-of-memory condition, forcing the termination of the affected node process and causing a localized denial of service.\nThe risk implication is high for cluster availability, as authenticated attackers can repeatedly crash cluster nodes with minimal effort and single small requests.\nExploitation requires valid user authentication with low privileges and network access to submit the malicious identifier request to the Elasticsearch cluster.",
  "technicalDetails": "The vulnerability resides in the identifier parsing and validation logic of Elasticsearch, specifically within the subsystem responsible for handling opaque identifiers.\nThe root cause is a validation logic flaw: the application performs deserialization of untrusted input data before confirming the cryptographic integrity or provenance of the opaque identifier.\nWithin the serialized payload, a size parameter dictates the memory allocation requirements for subsequent processing steps.\nThis size parameter is processed without bounds checking or validation against available heap resources, and it completely circumvents the Java Virtual Machine and Elasticsearch memory-usage controls or circuit breakers designed to prevent excessive memory consumption.\nThe attack flow proceeds as follows: First, a low-privileged authenticated user crafts a small HTTP request containing a forged opaque identifier designed with a maliciously inflated size value. Second, the Elasticsearch node receives the request and initiates the decoding and deserialization of the opaque identifier string. Third, because the authenticity check occurs post-deserialization, the application trusts the internal size metric and attempts to allocate the requested memory block. Fourth, the massive allocation request exhausts the available heap space, triggering an unrecoverable java.lang.OutOfMemoryError. Finally, the Java runtime or operating system terminates the affected Elasticsearch node process, resulting in a denial of service.\nThe vulnerable component is the request parsing and identifier validation pipeline. The authentication requirement is low-privileged authenticated access, meaning anonymous users cannot exploit the flaw without credentials, but any standard user account possesses sufficient privileges to submit the payload."
}