This vulnerability in Elasticsearch allows an authenticated user to trigger uncontrolled resource consumption through a specially crafted bulk request. The attack causes sustained high CPU consumption, leading to denial of service conditions on the affected node. The issue is classified under CWE-400 and involves excessive allocation as per CAPEC-130. The affected versions explicitly identified are 7.0.0 and 8.0.0. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. No official fix or patch has been announced by Elastic as of the publication date.

Successful exploitation results in denial of service due to sustained high CPU usage on the affected Elasticsearch node. This prevents the node from processing legitimate requests, impacting availability. There is no confidentiality or integrity impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit authenticated user access to trusted parties and monitor for unusual bulk request activity. No official remediation or temporary fix is currently available.