CVE-2022-35085

What it actually does

Memory leak in /lib/mem.c allows repeated allocation without corresponding release, leading to gradual exhaustion of available memory and eventual denial of service.

Why it matters to the business

Systems may experience progressive slowdowns or crashes under sustained load, increasing operational costs for restarts and monitoring while reducing service availability; prevalence in widely used packages amplifies exposure across many environments.

How an attack unfolds

An attacker supplies specially crafted input to a local process that exercises the leaking code path; over multiple invocations the leak accumulates until memory pressure triggers process termination or system instability.

How to fix it

Upgrade elastic/elasticsearch (GIT) to commit be13c699d0ab4706ec25626375b0965e3cdfa138 or later; rebuild any dependent packages against the patched source and verify the memory-management changes are present.

How to confirm the fix worked

Confirm the running binary or library was built from the fixed commit; run memory-leak detection tools under sustained load to verify allocations are released; monitor resident set size for stability.

Typical attack path

1. Identify a local process or utility that invokes the vulnerable memory allocation routines
2. Craft and repeatedly feed input that triggers the leak without triggering immediate crashes
3. Monitor system memory usage until exhaustion produces denial of service
4. Repeat or automate to maintain pressure on availability

How to detect it

Review process memory growth logs, system resource monitors, and any application logs that record allocation failures or out-of-memory events; correlate with execution of utilities known to use the affected code.

What your security team should do

• Prioritize patching all instances of the affected package within the next maintenance window
• Add memory-usage monitoring and alerting for processes that parse untrusted input
• Review build pipelines to ensure future updates pull from the corrected repository state