Executive brief
Elasticsearch, a widely used search and analytics engine, is vulnerable to a denial-of-service attack. An authenticated user with basic permissions can send a specifically crafted search query that consumes excessive system memory. This can cause the database node to crash, leading to service outages and data unavailability for the organization.
Technical details
A vulnerability classified as Uncontrolled Resource Consumption (CWE-400) exists in Elasticsearch's handling of Event Query Language (EQL) sequence queries. An authenticated attacker with low privileges and permission to execute EQL queries against an index they control can submit a specially crafted query that triggers excessive memory allocation (CAPEC-130). This resource exhaustion leads to a crash of the affected Elasticsearch node. The issue is resolved in versions 8.19.18, 9.3.7, and 9.4.4. Versions 9.5.0 and later are not affected.
Affected products
- Elastic Elasticsearch 8.0.0 - 8.19.17, 9.0.0 - 9.3.6, 9.4.0 - 9.4.3
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory
- 2026-07-21: patched: Fixed in 8.19.18, 9.3.7, and 9.4.4