Elasticsearch fails to impose an upper bound on a user‑supplied count used in a search highlighting request, and the resulting allocation is not subject to any circuit breaker. A single authenticated read‑only user can thus send a small search request that reserves an excessively large internal data structure, draining memory and causing a fatal error that terminates the node. This fault leads to a denial of service for the affected node and destabilises cluster routing and health. The weakness aligns with CWE‑789 – Unchecked Input Size or Buffer Size.

The vulnerability applies to the Elastic:Elasticsearch product. Specific version information is not provided in the data, but a search highlighting configuration that accepts a count parameter without a hard limit will be affected. The attack can target any searchable index in the cluster, regardless of its size, and effectively requires only read‑level access to the index.

The CVSS score of 6.5 classifies the flaw as medium severity. The EPSS score is not available, and the issue is not listed in CISA’s KEV catalog, indicating no known large‑scale exploitation. However, because the attack requires only a single request from an authenticated user with read rights, it is moderately easy to execute in environments where such access is broadly granted. The resulting node crash can bring the entire cluster offline, making it a significant operational threat. The absence of circuit‑breaker checks further lowers the barrier to exploitation, raising the risk when read‑only users are not tightly controlled.