A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing crafted input that causes a specific internal component to allocate memory without any upper bound. The allocation happens outside the existing memory accounting controls, leading to an out‑of‑memory condition that terminates the affected node process. The result is a denial of service for the node, which can cascade to affect the entire cluster’s availability.

The vulnerability affects Elastic Elasticsearch deployments. While the exact affected minor releases are not listed in the input, the provided reference indicates that versions 8.19.20 and 9.4.5 include a security update mitigating this issue. Older unpatched releases are at risk.

The CVSS score of 6.5 classifies the flaw as a moderate severity vulnerability. The EPSS score is not available, indicating that exploitation probability is currently unknown, and the vulnerability is not listed in CISA KEV. Based on the description, the likely attack vector is an authenticated request using read‑only privileges, and the attacker must supply crafted search input to trigger the unbounded memory allocation. Once triggered, the node terminates, resulting in a DoS that can destabilize the cluster if not mitigated.