EUVD-2026-41072
GHSA-p6pw-6f2m-xxpg
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
ML API is network-reachable but requires high-privilege credentials; only availability is impacted with no scope change beyond the targeted node.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
1DescriptionCVE.org
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated privileges can submit a specially crafted machine learning request that causes excessive memory consumption, which may render the affected node unavailable.
AnalysisAI
Elasticsearch's machine learning API contains an unbounded resource allocation flaw that allows an authenticated user with elevated privileges to crash an affected node by submitting a specially crafted ML request over the network. The absence of throttling or quota enforcement on ML request memory consumption (CWE-770) means the node's JVM heap can be exhausted, rendering it unavailable without any confidentiality or integrity exposure. No public exploit code has been identified at the time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Technical ContextAI
Elasticsearch is Elastic's distributed search, analytics, and machine learning engine, widely deployed as both on-premises clusters and managed cloud instances. The machine learning subsystem processes requests for anomaly detection, forecasting, and inference jobs via authenticated REST API calls. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the code path handling specially crafted ML requests does not enforce an upper bound on heap memory allocated per request, enabling CAPEC-130 (Excessive Allocation). When such a request is processed, the JVM on the targeted node allocates memory until heap exhaustion triggers an OutOfMemoryError or the node becomes unresponsive. The affected CPE is not enumerated in the available input, but the vendor advisory ESA-2026-43 identifies fixed versions across the 8.x and 7.x release lines.
RemediationAI
The primary remediation is to upgrade Elasticsearch to a patched release as identified in Elastic security advisory ESA-2026-43 at https://discuss.elastic.co/t/elasticsearch-8-19-17-9-3-6-9-4-3-security-update-esa-2026-43. Consult that advisory directly to confirm the exact fixed version applicable to your deployment branch, as version numbers are inferred from the URL slug rather than confirmed from structured patch data. Where immediate patching is not feasible, tighten Elasticsearch RBAC to reduce the number of users holding elevated ML-related privileges (e.g., machine_learning_admin or equivalent roles), accepting the trade-off that this narrows but does not eliminate the attack surface for trusted administrators. As a secondary compensating control, configure Elasticsearch circuit breakers - specifically the parent circuit breaker (indices.breaker.total.limit) and model inference circuit breaker - to bound per-request memory consumption; note that overly aggressive limits may degrade legitimate ML workload performance. Monitoring for anomalous JVM heap growth or ML API request rates on affected nodes is recommended regardless of patch status to enable rapid detection of exploitation attempts.
More in Elasticsearch
View allDirectory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit
Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deploymen
Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by an
The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secre
A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Le
The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today