Elasticsearch does not enforce an upper bound on a user-supplied count parameter used in a search highlighting option, and the memory allocation derived from this count is not accounted against any circuit breaker. An authenticated user with read privileges on a searchable index can submit a single small search request that causes the node to reserve an excessively large internal data structure. This allocation occurs before existing highlighting safety limits are evaluated, resulting in memory exhaustion that triggers a fatal error terminating the Elasticsearch node process. This denial of service degrades cluster routing and health. The vulnerability is independent of the size of indexed data and requires only one request to exploit.

The vulnerability allows an authenticated user with read privileges to cause a denial of service on an Elasticsearch node by exhausting memory through an unbounded allocation. This results in the termination of the node process, which degrades cluster routing and overall cluster health. There is no impact on confidentiality or integrity, only availability is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider restricting access to Elasticsearch nodes to trusted users only and monitor for unusual search highlighting requests. No official remediation or temporary fix has been provided by the vendor at this time.