A flaw in Elasticsearch causes a single, small, crafted document indexed by a low‑privileged authenticated user to monopolize a worker thread from a bounded pool, consuming it for an abnormally long time and degrading the availability of indexing operations on the affected node. This weakness is classified as CWE-407, representing inefficient algorithmic complexity, and results in a denial‑of‑service condition for indexing tasks, but does not directly disclose data or allow code execution.

The issue affects the Elasticsearch product from Elastic. Specific versions are not enumerated in the CVE data, so all deployments that may rely on the internal indexing thread pool should be considered potentially vulnerable until the vendor releases a fix.

The CVSS score of 4.3 indicates moderate severity, reflecting that the flaw requires authenticated access and is not a high‑impact exploit. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires a low‑privileged user with indexing permissions, implying that restricting such privileges or applying a vendor patch will mitigate the risk.