Elasticsearch is vulnerable to uncontrolled resource consumption (CWE‑400) and excessive allocation (CWE‑770). A crafted request can force the system to allocate excessive memory or CPU resources, causing the node or cluster to become unresponsive. The primary impact is a denial of service that can affect all users relying on the cluster for data indexing and search.

Elastic Elasticsearch is the affected product. No specific affected version information is supplied, so any Elasticsearch deployment that has not applied the latest security update may be susceptible.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score of < 1% shows a low exploitation probability. Based on the description and typical Elasticsearch deployment patterns, the likely attack vector is remote via the REST‑API endpoints that accept search or aggregation queries; a malicious actor could send large or complex requests to trigger the resource spike. It is inferred that an attacker would need network access to the cluster and that authentication may not be required, so systems exposed to the internet pose the highest risk. The vulnerability is not listed in CISA KEV.