Elasticsearch Excessive Memory Allocation Vulnerability Leading to Denial-of-Service

A vulnerability allowing excessive memory allocation has been identified in Elasticsearch. This issue arises from the allocation of resources without limits or throttling, and can be exploited by an authenticated user with snapshot restore privileges. The vulnerability allows for crafted HTTP requests to cause excessive memory use, leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes excessive memory consumption, leading to a denial-of-service condition where the application becomes unresponsive or unavailable.

Remediation

Users can upgrade to Elasticsearch versions 8.19.8, 9.1.8, or 9.2.2 to address this vulnerability.