The flaw is a resource exhaustion condition (CWE‑770) in the Elasticsearch analysis‑phonetic plugin. An authenticated user who can write documents to or search an index that uses an affected phonetic encoder can supply a specially crafted value. The plugin processes the value and allocates so much heap memory that the node becomes unresponsive or terminates, effectively denying service to the cluster.

Elastic Elasticsearch installations that employ the analysis‑phonetic plugin and have not applied the referenced security update (ESA‑2026‑235). The vulnerability affects any index that uses the affected encoder; no specific version range is listed, so the recommendation is to update to the latest supported package.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, suggesting limited public exploitation. However, the attack requires authenticated access with write or search privileges, so the threat is primarily to compromised or privileged accounts. If exploited, the node may exhaust its heap, become unresponsive or crash, impacting availability for the entire cluster.