Executive brief
Elasticsearch, a widely-used search and analytics engine, contains a vulnerability that allows privileged users to submit specially crafted requests causing excessive memory consumption. An attacker exploiting this flaw can render individual Elasticsearch nodes unavailable, disrupting search, logging, and analytics operations that depend on the service.
Technical details
This is a resource exhaustion vulnerability (CWE-770) in Elasticsearch where the system fails to properly throttle or limit memory allocation in response to certain requests. The vulnerability requires elevated privileges to exploit and network access to the Elasticsearch instance. An attacker can craft a malicious request that triggers excessive memory allocation, causing the affected node to become unavailable due to out-of-memory conditions. The issue is resolved in Elasticsearch versions 8.19.20 and 9.3.0 or later; no workarounds are available for unpatched systems.
Affected products
- Elastic Elasticsearch 8.0.0 to 8.19.19, 9.0.0 to 9.2.8
Timeline
- 2026-09-01: disclosed
- 2026-09-01: patched: Fixed in versions 8.19.20 and 9.3.0 and later