Add User Profile Size Limit Enforced During Profile Updates #137712

ebarlas · 2025-11-07T02:43:08Z

Currently, there are no limits on the size of a user profile. Profiles store username, initials, avatars, etc.

Authorized Kibana observability clients can store an unlimited amount of data in user profile via update-profile.

This change puts a limit on profile size to avoid heap memory pressure and OOM crashes.

A new configuration setting, xpack.security.profile.max_size, was introduced with a default value of 10 MB to remain safely above the 1 MB request limit size enforced by Kibana.

Limit enforcement is implemented with a profile document read before the update, to provide a full view of the profile footprint. This approach is intended to be lightweight. Still, a document read is now incurred for every update request.

…ential heap memory exhaustion.

elasticsearchmachine · 2025-11-07T02:43:58Z

Hi @ebarlas, I've created a changelog YAML for you.

legrego

@ebarlas, what will Kibana see in terms of HTTP status code & error payload when this limit is hit? I ask because I feel we should monitor this within our SLOs. I want to make sure we have a way to reliably detect this condition, and distinguish it from other potential failure scenarios.

ebarlas · 2025-11-12T23:30:38Z

What will Kibana see in terms of HTTP status code & error payload when this limit is hit?

Elasticsearch request processing will fail with an ElasticsearchException, which results in a 400 Bad Request response with a detailed message.

Here's a curl snippet for reference:

curl -i -k -X PUT "https://localhost:9200/_security/profile/${PROFILE_UID}/_data" -u '...' -H "Content-Type: application/json" -d '{...}'
HTTP/1.1 400 Bad Request
...

{"error":{"root_cause":[{"type":"exception","reason":"cannot update profile [...] because the combined profile size of [...] bytes exceeds the maximum of [...] bytes"}],"type":"exception","reason":"cannot update profile [...] because the combined profile size of [...] bytes exceeds the maximum of [...] bytes"},"status":400}

jfreden

Good job! This approach LGTM! I've left some comments, let me know what you think.

jfreden · 2025-11-13T10:59:11Z

...k/plugin/security/src/main/java/org/elasticsearch/xpack/security/profile/ProfileService.java

+        Map<String, Object> data = combineMaps(mapFromBytesReference(doc.doc.applicationData()), request.getData());
+        int actualSize = serializationSize(labels) + serializationSize(data);
+        if (actualSize > limit) {
+            throw new ElasticsearchException(


I think this should be an IllegalArgumentException and result in a 400 since it's caused by an issue triggered by a series of bad requests. WDYT?

Good point. ElasticsearchStatusException looks like a good option.

@legrego , I updated my comment above to reflect the 400 Bad Request response change.

Thanks @ebarlas

jfreden · 2025-11-13T11:01:47Z

...k/plugin/security/src/main/java/org/elasticsearch/xpack/security/profile/ProfileService.java


 public class ProfileService {
+
+    public static final Setting<Integer> MAX_SIZE_SETTING = Setting.intSetting(


Should this be a ByteSizeValue Setting then you can set it to 10mb?

Good catch!

jfreden · 2025-11-13T11:04:48Z

...k/plugin/security/src/main/java/org/elasticsearch/xpack/security/profile/ProfileService.java

+        return XContentHelper.convertToMap(bytesRef, false, XContentType.JSON).v2();
+    }
+
+    static int serializationSize(Map<String, Object> map) {


jfreden · 2025-11-13T11:05:59Z

...k/plugin/security/src/main/java/org/elasticsearch/xpack/security/profile/ProfileService.java

+
+    static Map<String, Object> mapFromBytesReference(BytesReference bytesRef) {
+        if (bytesRef == null || bytesRef.length() == 0) {
+            return new HashMap<>();


nit: this could be Map.of()

jfreden · 2025-11-13T11:13:15Z

...k/plugin/security/src/main/java/org/elasticsearch/xpack/security/profile/ProfileService.java

+        if (actualSize > limit) {
+            throw new ElasticsearchException(
+                Strings.format(
+                    "cannot update profile [%s] because the combined profile size of [%s] bytes exceeds the maximum of [%s] bytes",


I think using a human readable size here (like 10mb) would be nice.

Much better!

jfreden · 2025-11-13T11:14:28Z

Can you take the PR out of draft mode?

elasticsearchmachine · 2025-11-13T17:09:12Z

Pinging @elastic/es-security (Team:Security)

jfreden

LGTM! Just a comment on the default value that I think was accidentally set to 100MB.

...k/plugin/security/src/main/java/org/elasticsearch/xpack/security/profile/ProfileService.java

…ecurity/profile/ProfileService.java Co-authored-by: Johannes Fredén <109296772+jfreden@users.noreply.github.com>

…137712) Add a configurable size limit for user profiles stored in Elasticsearch. This limit prevents large profiles from exhausting heap memory and impacting cluster stability. (cherry picked from commit 860ad79)

ebarlas · 2025-11-26T17:40:56Z

💚 All backports created successfully

Status	Branch	Result
✅	9.2
✅	9.1
✅	8.19

Questions ?

Please refer to the Backport tool documentation

Add a profile size limit enforced during profile updates to avoid pot…

6ae5de6

…ential heap memory exhaustion.

ebarlas requested a review from a team November 7, 2025 02:43

ebarlas self-assigned this Nov 7, 2025

ebarlas added >bug :Security/Security Security issues without another label Team:Security Meta label for security team labels Nov 7, 2025

elasticsearchmachine added the v9.3.0 label Nov 7, 2025

Update docs/changelog/137712.yaml

5e80c14

ebarlas added 2 commits November 6, 2025 18:57

Use Strings#format rather than String#formatted

4cbc3b2

Add a configuration setting for profile max size quota

b083911

legrego reviewed Nov 12, 2025

View reviewed changes

jfreden reviewed Nov 13, 2025

View reviewed changes

Use ByteSizeValue type for profile size setting

da5ca38

ebarlas marked this pull request as ready for review November 13, 2025 17:08

jfreden approved these changes Nov 14, 2025

View reviewed changes

...k/plugin/security/src/main/java/org/elasticsearch/xpack/security/profile/ProfileService.java Outdated Show resolved Hide resolved

ebarlas and others added 2 commits November 14, 2025 14:21

Update x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/s…

2880988

…ecurity/profile/ProfileService.java Co-authored-by: Johannes Fredén <109296772+jfreden@users.noreply.github.com>

Merge branch 'main' into profile-size-validation

19d4d22

ebarlas merged commit 860ad79 into elastic:main Nov 17, 2025
40 checks passed

ebarlas added v9.2.2 v8.19.8 v9.1.8 labels Nov 26, 2025

ebarlas mentioned this pull request Nov 26, 2025

[9.2] Add User Profile Size Limit Enforced During Profile Updates (#137712) #138689

Open

ebarlas mentioned this pull request Nov 26, 2025

[9.1] Add User Profile Size Limit Enforced During Profile Updates (#137712) #138690

Merged

ebarlas mentioned this pull request Nov 26, 2025

[8.19] Add User Profile Size Limit Enforced During Profile Updates (#137712) #138691

Merged


		public class ProfileService {

		public static final Setting<Integer> MAX_SIZE_SETTING = Setting.intSetting(

Add User Profile Size Limit Enforced During Profile Updates #137712

Add User Profile Size Limit Enforced During Profile Updates #137712

Uh oh!

Conversation

ebarlas commented Nov 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

elasticsearchmachine commented Nov 7, 2025

Uh oh!

legrego left a comment

Choose a reason for hiding this comment

Uh oh!

ebarlas commented Nov 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jfreden left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ebarlas Nov 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jfreden commented Nov 13, 2025

Uh oh!

elasticsearchmachine commented Nov 13, 2025

Uh oh!

jfreden left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ebarlas commented Nov 26, 2025

💚 All backports created successfully

Questions ?

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

ebarlas commented Nov 7, 2025 •

edited

Loading

ebarlas commented Nov 12, 2025 •

edited

Loading

ebarlas Nov 13, 2025 •

edited

Loading