An uncontrolled resource consumption flaw (CWE‑400) in Elasticsearch’s ES|QL engine permits an attacker to craft a query that triggers exponential CPU usage during evaluation. The resulting resource exhaustion persists after the query completes, allowing repeated exploitation to deplete the pool of query‑worker threads and render all ES|QL queries unavailable until the node is restarted. The flaw does not leak data or modify system state, but it does compromise availability.

The vulnerability affects Elastic’s Elasticsearch product. No specific version information is supplied in the advisory, so any deployment of Elasticsearch that implements the ES|QL engine could be susceptible unless mitigated by the vendor’s patch. The attacker must be an authenticated user with permissions to submit ES|QL queries, and no special network privilege is required beyond that access.

The flaw carries a CVSS score of 6.5, indicating moderate severity, while the EPSS score of <1 % suggests a low current exploitation probability. Because the ability to submit a dangerous query requires valid authentication, the attack does not need public network exposure, but any compromised or privileged account can disrupt availability. The vulnerability is not listed in CISA’s KEV catalog, yet the potential for sustained service disruption warrants proactive remediation.