Elasticsearch is vulnerable to uncontrolled resource consumption (CWE-400) that forces sustained high CPU usage on the node. The vulnerability leverages bulk API requests (Excessive Allocation, CAPEC-130) which, when submitted by an authenticated user, can keep the node in a state of constant CPU consumption, preventing it from processing legitimate traffic and effectively denying service to clients that depend on the affected node.

The flaw applies to Elastic Elasticsearch deployments that allow authenticated bulk indexing. Any instance where users can use the bulk API with valid credentials may be impacted, regardless of version, as the vendor has not provided specific version ranges.

6.5 indicates a moderate severity. An EPSS score of less than 1% suggests that exploitation is unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog. An attacker must first authenticate to the cluster; once authenticated, they can craft bulk requests that keep CPU consumption high for extended periods, leading to denial of service. The moderate score combined with the requirement for valid credentials recommends proactive mitigation.