Executive brief
Elasticsearch, a widely used search and analytics engine, is vulnerable to a denial-of-service attack. An authenticated user with search permissions can send a specially crafted request that exhausts the system's memory. This can lead to service outages, cluster instability, and may require manual intervention to restore normal operations.
Technical details
A vulnerability classified as Uncontrolled Resource Consumption (CWE-400) exists in Elasticsearch. The flaw is triggered when a user with search privileges submits a specially crafted search request that causes a data node to exhaust its available heap memory (CAPEC-130). This is a network-based attack that requires low privileges (authenticated search access) but no user interaction. The resulting memory exhaustion leads to node unavailability and potential cluster-wide degradation. The issue is resolved in Elasticsearch versions 8.19.15, 9.2.9, and 9.3.4. The 9.4.x release line is not affected.
Affected products
- Elastic Elasticsearch 8.0.0 to 8.19.14, 9.0.0 to 9.2.8, 9.3.0 to 9.3.3
Timeline
- 2026-07-21: advisory: Public disclosure by Elastic and NVD publication
- 2026-07-21: patched: Fixes released in versions 8.19.15, 9.2.9, and 9.3.4