Executive brief
Elasticsearch is a widely-used search and analytics database engine. An authenticated user can submit specially crafted queries in ES|QL (Elasticsearch Query Language) that cause the server to allocate excessive memory, exhausting the node's heap and crashing the service. This directly impacts availability of search and analytics operations for all users accessing that node.
Technical details
This is a memory allocation vulnerability (CWE-789) in the ES|QL query processing component. An attacker with valid credentials and authorization to submit ES|QL queries can craft a query that triggers unbounded heap memory allocation during evaluation. The root cause is insufficient validation or limits on memory allocation in the query execution engine. Attack requires network access to Elasticsearch and a valid authenticated account with ES|QL query permissions; no further user interaction is needed. Successful exploitation causes a denial of service by exhausting available heap memory and crashing the affected node. The vulnerability was fixed in Elasticsearch versions 8.18.0 and 9.0.0. Versions 8.11.0 through 8.17.9 are affected (ES|QL was introduced in 8.11.0).
Affected products
- Elastic Elasticsearch 8.11.0 through 8.17.9
Timeline
- 2026-08-13: disclosed
- 2026-08-13: patched: Fixed in Elasticsearch 8.18.0 and 9.0.0