Elasticsearch contains a memory allocation flaw where an authenticated user with only read rights on a single index can craft a small search request that requests an excessively large allocation. The resulting over‑commitment of the JVM heap can exhaust available memory and terminate the affected node, leading to a denial of service for that node and potentially the entire cluster. The weakness is a classic CWE‑789 Excessive Allocation vulnerability, which can be leveraged through a carefully constructed query payload. Without mitigation, any user with read access to an index can trigger the crash.

The vulnerability affects Elastic’s Elasticsearch product. No specific version range is listed, so all installations of Elasticsearch that have not applied the referenced fix are potentially susceptible. The referenced discussion advises applying the latest security update provided by Elastic.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not available. The vulnerability is not currently tracked in the CISA KEV catalog. The attack vector requires authenticated access with read privileges on an index, and the attacker can exploit it by submitting a single crafted search request. Once exploited, the node will restart due to heap exhaustion, causing a temporary denial of service until the node recovers. Prevention relies on applying the official patch or mitigating input size constraints, as the failure occurs from unvalidated user‑supplied allocation sizes.