This vulnerability (CWE-789) in Elasticsearch allows an authenticated user with limited read privileges to cause a denial of service by submitting a small, specially crafted search request that forces the JVM to allocate an excessively large amount of memory. This excessive allocation exhausts the JVM heap, leading to termination of the affected Elasticsearch node. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact. The vulnerability affects specific versions 8.0.0, 9.0.0, and 9.5.0. No known exploits in the wild or vendor patches are currently documented.

Successful exploitation results in denial of service by exhausting the JVM heap memory of the Elasticsearch node, causing it to terminate and become unavailable. There is no impact on confidentiality or integrity. The attack requires network access and low privileges (read-only authenticated user).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user privileges carefully and monitor for unusual search requests that may trigger excessive memory allocation. No official fix or temporary workaround is currently documented.