Technical impact
The vulnerability is an uncontrolled resource consumption flaw that can cause excessive allocation of memory or other resources in Elasticsearch, leading to a denial of service. It is classified as CWE-400 and CWE-770 and can be triggered by requests that force the system to allocate more resources than intended, ultimately exhausting available capacity.
Affected Systems
The affected vendor and product are Elastic: Elasticsearch. No specific version information is provided in the data, so any running instance of Elasticsearch may be susceptible until an update is applied.
Risk and Exploitability
The CVSS score of 6.5 indicates moderate severity. The EPSS score of < 1% indicates a very low but not zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote, via HTTP or cluster management interfaces that allow construction of resource-intensive queries. The attack requires network access to the Elasticsearch cluster and the ability to send sufficiently large or complex requests. If exploited, the cluster may become unresponsive to legitimate workloads, impacting availability for all users of the service.
