The vulnerability is a classic excessive memory allocation flaw (CWE‑789) found in the ES|QL query engine of Elasticsearch. An authenticated user with permission to submit ES|QL queries can craft a query that causes the node to allocate an unbounded amount of heap memory during its evaluation. This can exhaust the node’s available memory, rendering the cluster node unavailable and effectively denying service to legitimate users.

Elastic:Elasticsearch is the affected product. No specific version range is provided in the advisory; organizations should examine their Elasticsearch deployments and consider that all releases before the forthcoming security fix may be impacted.

The CVSS score of 6.5 indicates a medium severity vulnerability. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, suggesting no known active exploits at the time of reporting. The attack vector requires authenticated access to submit ES|QL queries, so risk is confined to users with query privileges. If an attacker can acquire such credentials, they could trigger a denial of service condition on the node that hosts the query, potentially affecting cluster availability.