EUVD-2026-58251
GHSA-gf23-7gr9-6992
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable endpoint requiring low-privilege authentication; no confidentiality or integrity impact; availability impact is high due to fatal node process termination.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the identifier drives an allocation that is neither capped nor accounted for by the available memory-usage controls. The resulting out-of-memory condition is fatal and terminates the affected node process, resulting in a denial of service.
AnalysisAI
Denial of service in Elasticsearch allows any low-privileged authenticated user to crash an affected cluster node with a single crafted HTTP request. The root flaw is a validate-after-deserialize ordering error: Elasticsearch decodes and deserializes an opaque identifier before confirming the cluster issued it, and an attacker-controlled size value embedded in the forged identifier drives an uncapped heap allocation (CWE-789) that exhausts available memory and fatally terminates the node process. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Technical ContextAI
Elasticsearch (cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*) uses opaque identifiers - encoded, serialized tokens - in certain request paths to carry cluster-internal state. The vulnerability is classified CWE-789 (Uncontrolled Memory Allocation): a size field embedded within the identifier is consumed to drive a heap allocation before any authenticity check is applied to the token, allowing an attacker to supply an arbitrarily large size value. The lack of memory-usage caps or accounting on this allocation path means a single request can exhaust node memory entirely, triggering an out-of-memory kill. The validate-before-deserialize pattern would have prevented this; the inverted order is the architectural root cause.
RemediationAI
Upgrade Elasticsearch to version 8.19.20, 9.4.5, or 9.5.1 as applicable per Elastic security advisory ESA-2026-79 (https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-79/389506). If immediate patching is not possible, restrict Elasticsearch API access to the minimum necessary set of authenticated users and enforce network-level controls (firewall, reverse proxy ACLs) to prevent access from untrusted internal principals. Revoking or rotating credentials for users with low-privilege cluster access reduces the attacker pool but does not eliminate the underlying flaw. Note that restricting API access may impact dependent applications or observability pipelines - validate upstream integrations before applying access controls.
More in Elasticsearch
View allThe Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit
Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deploymen
Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by an
The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secre
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today