A reachable assertion flaw (CWE-617) in Elasticsearch allows a crafted search request containing a null value to trigger an internal assertion during query parsing. Because Elasticsearch treats assertion failures as fatal, the node process crashes, leading to a denial of service. The flaw can be exercised with a single request by any authenticated user who has read access to at least one index, allowing an attacker to disrupt search availability.

Elastic Elasticsearch products are affected. Specific affected versions are not listed in the available information, so all current deployments should be reviewed against Elastic’s security advisory.

The vulnerability has a CVSS score of 6.5, indicating moderate severity, and an EPSS score of less than 1 %, implying a low likelihood of exploitation in the wild. It is not present in the CISA KEV catalog. Attackers must be authenticated and possess index read permissions; once those conditions are met, a single HTTP request can terminate a node in a single‑node deployment or reduce cluster capacity in a multi‑node cluster. The attack vector is inferred as exploiting the query parsing routine via the REST API.