Описание
A flaw was found in Elasticsearch. An authenticated user with read privileges can submit a crafted request that causes the node to attempt an excessively large memory allocation due to unvalidated user input. This memory exhaustion leads to a fatal error, terminating the Elasticsearch node process and causing a Denial of Service (DoS) for the affected node. A single request is sufficient to trigger this issue.
Отчет
An unvalidated allocation flaw exists in Elasticsearch's API request processing mechanisms. When handling user-supplied size parameters during data structure initialization, Elasticsearch fails to bound memory allocation requests. An authenticated remote user with read-only privileges can submit a single crafted API request, forcing an excessively large heap allocation that triggers an Out-Of-Memory (OOM) fatal error and crashes the node process. This results in service disruption and degraded cluster health, posing a high impact to availability.
Меры по смягчению последствий
Restrict API access permissions using Elasticsearch role-based access control (RBAC) so that only trusted users can access read endpoints. Additionally, configure request circuit breakers (indices.breaker.request.limit) to enforce strict memory allocation caps per request execution.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-feature-server-rhel9 | Under investigation | ||
| Red Hat Quay 3 | quay/quay-rhel8 | Under investigation | ||
| Red Hat Quay 3 | quay/quay-rhel9 | Under investigation |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to attempt an excessively large allocation. The resulting memory exhaustion raises a fatal error that terminates the Elasticsearch node process, causing a denial of service for the affected node and degrading cluster health. The defect is not volumetric, so a single request is sufficient regardless of the heap size configured on the target node.
Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to attempt an excessively large allocation. The resulting memory exhaustion raises a fatal error that terminates the Elasticsearch node process, causing a denial of service for the affected node and degrading cluster health. The defect is not volumetric, so a single request is sufficient regardless of the heap size configured on the target node.
EPSS
6.5 Medium
CVSS3