Allocation of resources without limits (CWE-770) allows an attacker with privileged access to send a crafted request to Elasticsearch that can cause the node to consume excessive memory, resulting in a denial of service. The problem is a lack of resource throttling when handling user‑supplied data, leading to potential exhaustion of memory resources. This type of flaw can result in system unavailability for legitimate users but does not directly compromise confidentiality or integrity on its own.

Elastic:Elasticsearch. No specific release numbers are listed; the vulnerability is reported for the Elasticsearch product line in general.

The CVSS score of 4.9 indicates a medium severity. No EPSS score is provided, so the exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is through a privileged API request or administrative console that allows an attacker to send a specially crafted query. An attacker would first need elevated privileges within the Elasticsearch cluster to exploit this flaw. Once triggered, the excessive memory allocation can cause the node to become unresponsive, leading to a denial of service.