EUVD-2026-58279
GHSA-gpg2-7m3g-5qc5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-delivered ES|QL query requires only a low-privilege account; no data exposure or integrity impact, only heap exhaustion with high availability consequence on the targeted node.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation allocates an unbounded amount of heap memory, exhausting the available heap on the receiving node and causing the node to become unavailable.
AnalysisAI
ES|QL query processing in Elasticsearch allows an authenticated low-privileged user to exhaust heap memory on any receiving cluster node by submitting a specially crafted query, rendering that node unavailable. The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects remote, low-complexity exploitation requiring only a valid account, with high availability impact but no data exposure. Elastic has released fixes in versions 8.18.0 and 9.0.0 per advisory ESA-2026-111; no public exploit or active exploitation has been identified at time of analysis.
Technical ContextAI
Elasticsearch's ES|QL (Elasticsearch Query Language) is a pipeline-based query language introduced in the 8.x series for analytics over data streams and indices. The vulnerability stems from CWE-789 (Memory Allocation with Excessive Size Value): the ES|QL query execution engine fails to enforce upper bounds on heap memory requested during query plan evaluation, enabling a CAPEC-130 (Excessive Allocation) attack pattern. When the engine processes certain query constructs, it allocates heap memory proportional to values or structures in the query without capping the allocation, causing unbounded JVM heap growth. The CPE cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:* indicates the flaw spans across all prior Elasticsearch versions with ES|QL support. Unlike Elasticsearch's Query DSL circuit breakers - which guard against result-set sizes - this flaw appears to bypass or predate those protections at the query planning or intermediate data structure layer.
RemediationAI
Upgrade Elasticsearch to version 8.18.0 (for 8.x deployments) or 9.0.0 (for 9.x deployments), as documented in Elastic security advisory ESA-2026-111 at https://discuss.elastic.co/t/elasticsearch-8-18-0-9-0-0-security-update-esa-2026-111/389495. If an immediate upgrade is not possible, restrict ES|QL query execution privileges using Elasticsearch RBAC by removing the manage_index or query execution privileges from roles that do not require ES|QL access - this is the most targeted compensating control but may break existing analytics pipelines that rely on ES|QL. Additionally, tuning JVM heap settings and Elasticsearch circuit breaker thresholds (e.g., indices.breaker.total.limit) can reduce the blast radius by causing an earlier, controlled exception rather than full node exhaustion, though this does not prevent the attack. Network-level controls restricting which authenticated principals can reach the Elasticsearch HTTP API further reduce exposure in multi-tenant environments.
More in Elasticsearch
View allThe Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit
Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deploymen
Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by an
The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secre
Same technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today