Executive brief
Elasticsearch, a widely used search and analytics engine, is vulnerable to a denial-of-service attack. An authenticated user can send a specially crafted data request that consumes excessive processor resources. This can cause the system to become unresponsive, preventing legitimate users and applications from accessing or searching data.
Technical details
A vulnerability classified as Uncontrolled Resource Consumption (CWE-400) exists in Elasticsearch's bulk API. An authenticated attacker can submit a specially crafted bulk request that triggers excessive allocation and sustained high CPU consumption (CAPEC-130). This resource exhaustion can render the affected node unable to process further requests, leading to a denial of service. The issue affects versions 7.x up to 7.17.23 and 8.x up to 8.14.3. It has been remediated in versions 7.17.24 and 8.15.0.
Affected products
- Elastic Elasticsearch 7.0.0 to 7.17.23, 8.0.0 to 8.14.3
Timeline
- 2026-07-01: disclosed
- 2026-07-01: advisory
- 2026-07-01: patched