# Too many wildcards in the search request causes system to immediately shoot to 100% CPU, HEAP- DOS attack

**URL:** <https://discuss.elastic.co/t/too-many-wildcards-in-the-search-request-causes-system-to-immediately-shoot-to-100-cpu-heap-dos-attack/219508>\
**Category:** Elasticsearch\
**Created:** [February 16, 2020, 8:37am UTC](https://discuss.elastic.co/t/too-many-wildcards-in-the-search-request-causes-system-to-immediately-shoot-to-100-cpu-heap-dos-attack/219508 "2020-02-16T08:37:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![shamzeer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shamzeer/32/71513_2.png) [@shamzeer](https://discuss.elastic.co/u/shamzeer)\
**Post date:** [February 16, 2020, 8:37am UTC](https://discuss.elastic.co/t/too-many-wildcards-in-the-search-request-causes-system-to-immediately-shoot-to-100-cpu-heap-dos-attack/219508/1 "2020-02-16T08:37:37Z")

</div>

Hi,  
Greetings!!

We recently came across a case where when there are wild card search like " _a_b _bcd_ _xyz_" (just an example to indicate that wild cards are present beginning and end or anywhere on multiple words). Similar searches when lot of users execute in parallel the server does not respond and resources shoots 100%. The only option to recover was to restart the cluster.

This falls to a potential case for ddos attacks. Is there any configuration or a control that can be kept in the query to kill the request if it takes more time like 5second or so and release the resources used by this query?

search string did not carry \* in the forum.. hence expanding it to words (ST)=\*  
" (ST)a(ST) b (ST)bcd(ST) (ST)z(ST) "

ES versions in use are 7.0, 6.1

---

<div class="post-metadata">

**Author:** ![spinscale](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spinscale/32/25011_2.png) [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Post date:** [February 17, 2020, 10:49am UTC](https://discuss.elastic.co/t/too-many-wildcards-in-the-search-request-causes-system-to-immediately-shoot-to-100-cpu-heap-dos-attack/219508/2 "2020-02-17T10:49:14Z")

</div>

Such a setting has very recently been added for the next minor version, see [https://github.com/elastic/elasticsearch/pull/51385](https://github.com/elastic/elasticsearch/pull/51385)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 16, 2020, 10:49am UTC](https://discuss.elastic.co/t/too-many-wildcards-in-the-search-request-causes-system-to-immediately-shoot-to-100-cpu-heap-dos-attack/219508/3 "2020-03-16T10:49:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.