This vulnerability in Elasticsearch arises from improper resource allocation controls during machine learning requests. A privileged user can exploit this by submitting a specially crafted request that causes excessive memory usage, potentially leading to denial of service conditions on the affected node. The CVSS 3.1 base score is 4.9 (medium), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact. Affected versions explicitly include 8.0.0, 9.0.0, and 9.4.0. No vendor advisory or patch information is currently available.

Successful exploitation results in denial of service due to excessive memory consumption on the affected Elasticsearch node. This can cause the node to become unavailable, impacting availability of the service. There is no impact on confidentiality or integrity according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict elevated privileges to trusted users only and monitor resource usage to detect potential abuse of machine learning requests.