Description

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-09-26T21:16:56.630Z",
  "pubdate": "2026-09-26T21:16:56.630Z",
  "executiveSummary": "This vulnerability is classified as Uncontrolled Resource Consumption (CWE-400), specifically manifesting as Excessive Allocation (CAPEC-130) within Elasticsearch clusters.\nThe vulnerability allows an unauthenticated or authenticated attacker to trigger an exhaustion of critical system resources—such as heap memory, CPU cycles, or thread pools—by submitting maliciously crafted requests that force the engine to perform unbounded operations.\nThe primary impact is a Denial of Service (DoS), rendering the Elasticsearch instance unresponsive to legitimate search, indexing, or cluster management operations.\nThis flaw is inherent to the resource management logic when processing complex or highly nested queries, massive bulk requests, or oversized aggregations without sufficient circuit-breaking mechanisms.\nRisk implications are high for production environments where availability is critical, as a single malicious request can cause JVM-level failures or instability in the cluster's coordination layer.\nExploitation requires no specialized privileges in environments where the cluster is exposed to external traffic, allowing an attacker to destabilize the service remotely by bypassing default resource quotas.",
  "technicalDetails": "The root cause of this vulnerability lies in the Elasticsearch query execution engine's failure to adequately enforce limits on resource-intensive operations during the parsing and execution phases. When a user submits a query or aggregation that involves deeply nested boolean logic, wildcard expressions, or high-cardinality terms, the Elasticsearch engine may allocate memory or CPU resources disproportionate to the input size.\nThe attack flow initiates when an attacker sends a specialized payload to the Elasticsearch REST API. This payload is engineered to maximize the computational complexity of the search request. As the cluster begins to process the request, the query execution engine creates a large number of internal objects, such as bitsets or score calculators, which consume heap memory beyond the threshold defined for individual requests.\nBecause the resource consumption is uncontrolled, the cluster's circuit breaker mechanisms may fail to trigger before the JVM enters a Garbage Collection (GC) pressure spiral or exhausts the available memory heap. This leads to long-running stop-the-world GC pauses or an OutOfMemoryError (OOME), causing the node to become unresponsive or crash.\nIn the context of CAPEC-130 (Excessive Allocation), the attacker repeatedly floods the cluster with these resource-heavy requests. Even if a single request does not immediately crash the node, the cumulative effect of concurrent requests leads to resource saturation. This impacts the thread pool associated with search operations, effectively queueing legitimate traffic until the node reaches a state of Denial of Service.\nThe vulnerable component is primarily the Search and Query Execution module. Exposure is exacerbated when the Elasticsearch instance is deployed with default configuration settings that lack strict request-level limits, such as 'indices.breaker.total.limit' or 'indices.query.bool.max_clause_count'.\nPost-exploitation impact involves full service unavailability. If the node is part of a multi-node cluster, the failure of a single node can trigger excessive shard rebalancing, leading to a cascade effect that degrades the performance of the entire cluster, potentially inducing a cluster-wide outage."
}