CLEANSTART-2026-DF57454: asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow c...
Security vulnerability affects the elasticsearch package. The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/elasticsearchto a version that resolves this vulnerability.Fixed in 9.2.8-r13 - Upgrade
Upgrade
cleanstart/elasticsearchto a version that resolves this vulnerability.Fixed in 9.5.5-r5
Frequently Asked Questions
Who is exposed to this issue?
Deployments using the elasticsearch package are exposed when they process untrusted Smile data through the asynchronous NonBlockingByteArrayParser.
What does an attacker need to provide to trigger the vulnerable allocation?
An attacker needs to control the raw-binary length prefix in Smile input handled by the asynchronous parser. That prefix is used to allocate a byte array before the raw-binary body is read, without an upper-bound or overflow check.