Elasticsearch does not validate a size value taken from user‑supplied input before reserving memory for an internal data structure. An authenticated user with read privileges can submit a single crafted request to the vulnerable API endpoint, causing the node to attempt an excessively large allocation. The resulting memory exhaustion triggers a fatal error that terminates the Elasticsearch node process, leading to denial of service for the affected node and degrading overall cluster health.

Elastic:Elasticsearch instances that contain the described defect. No specific version information is provided, so any deployment of Elasticsearch that could potentially include this code path is vulnerable.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score of less than 1% reflects a very low current likelihood of exploitation in the wild, and the vulnerability is not listed in CISA KEV. Nevertheless, the attack requires only an authenticated read‑only user and a single request; the vulnerable API endpoint is the attack vector, and successful exploitation will crash the node and potentially impact cluster availability.