Executive brief
Elasticsearch is a widely-used search and analytics engine that stores and indexes data for rapid retrieval. A flaw in memory handling allows an authenticated read-only user to crash the Elasticsearch service by submitting a specially crafted search query that causes the server to allocate excessive memory and exhaust the JVM heap, rendering the service unavailable.
Technical details
This vulnerability involves improper memory allocation (CWE-789) triggered by a specially crafted search request in Elasticsearch. An authenticated attacker with read-only privileges on at least one index can send a small search query that causes the Elasticsearch node to allocate an excessively large amount of memory, exhausting the JVM heap and forcing the node to terminate. The attack requires network access and valid authentication credentials, but no special privileges beyond read access on a single index. The vulnerability has been patched in versions 8.19.20, 9.4.5, and 9.5.1; no workarounds are available for unpatched instances.
Affected products
- Elastic Elasticsearch 8.0.0–8.19.19, 9.0.0–9.4.4, 9.5.0
Timeline
- 2026-08-13: disclosed: Published via Elastic security advisory ESA-2026-116
- 2026-08-13: patched: Fixed in versions 8.19.20, 9.4.5, and 9.5.1