EUVD-2026-58248
GHSA-78xm-g482-ch2r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable search API, no complexity or interaction required, read credentials needed (PR:L), and impact is total availability loss with no confidentiality or integrity effect.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the scope of the existing memory accounting controls that were intended to constrain it. The resulting out-of-memory condition is fatal and terminates the affected node process, causing a denial of service.
AnalysisAI
Denial of service in Elasticsearch allows an authenticated user with only read privileges to crash a cluster node by submitting a crafted search request. Processing the malicious input triggers unbounded memory allocation in a specific internal component, bypassing existing memory accounting controls and causing a fatal out-of-memory condition that terminates the affected node process. No public exploit code has been identified at time of analysis, but the low privilege requirement (read-only access) significantly broadens the potential attacker pool in multi-tenant or SaaS deployments.
Technical ContextAI
Elasticsearch is a distributed search and analytics engine widely deployed for log aggregation, observability, and full-text search workloads. The vulnerability is rooted in CWE-770 (Allocation of Resources Without Limits or Throttling): a specific internal processing component - invoked during search query evaluation - performs memory allocation based on user-controlled input without enforcing an upper bound. Critically, this allocation path is outside the scope of Elasticsearch's existing circuit breaker mechanism, which is the primary defense against query-induced memory exhaustion. The affected scope is identified via CPE cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:* covering the broad Elasticsearch product line. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H confirms the flaw is remotely exploitable over a network with low complexity and no user interaction required beyond having read credentials.
RemediationAI
Upgrade Elasticsearch to version 8.19.20 or 9.4.5 as specified in Elastic security advisory ESA-2026-76, available at https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-76/389508. For clusters that cannot be immediately patched, consider restricting who can obtain read credentials - revoke or scope down API keys that are not actively needed, reducing the potential attacker pool. Additionally, configuring Elasticsearch's existing circuit breakers more aggressively (indices.breaker.total.limit, network.breaker.inflight_requests.limit) may provide partial mitigation, though the description explicitly states the vulnerable allocation bypasses existing accounting controls, so this is not a reliable workaround. Enabling search throttling or rate-limiting at the load-balancer or gateway layer for the Elasticsearch REST API can reduce the rate at which an attacker can re-trigger the crash, but does not eliminate the vulnerability. Enabling auto-restart of Elasticsearch node processes (e.g., via systemd Restart=always) can reduce downtime from crash loops but does not prevent the denial of service. Patching to the fixed versions is the only confirmed remediation.
More in Elasticsearch
View allThe Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit
Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deploymen
Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by an
The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secre
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today