CVE-2026-102411

Analyzed Analyzed - Analysis Complete

Allocation of Resources Without Limits in Elasticsearch

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: Elastic

Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, but does not limit the total memory used when multiple such resources are retrieved together. A user holding the *manage_index_templates* cluster privilege can register multiple resources each within the individual limit. Retrieving them together materializes all of their metadata values in memory at once, exhausting available heap and causing the affected node to fail with an out-of-memory error, resulting in a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102411

EUVD

EUVD-2026-93932

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	From 9.5.0 (inc) to 9.5.3 (exc)
elastic	elasticsearch	From 9.0.0 (inc) to 9.4.7 (exc)
elastic	elasticsearch	From 8.0.0 (inc) to 8.19.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This is an Allocation of Resources Without Limits vulnerability (CWE-770) in Elasticsearch that can cause Denial of Service via Excessive Allocation (CAPEC-130). It occurs when multiple template resources are retrieved together, each within individual size limits, but collectively exhausting heap memory. This leads to an out-of-memory error and node failure.

Detection Guidance

This vulnerability can be detected by monitoring Elasticsearch heap usage and checking for excessive memory consumption during template retrieval. Look for nodes failing with out-of-memory errors when multiple index templates are accessed simultaneously. Check Elasticsearch logs for heap exhaustion events and monitor system memory usage during template operations.

Impact Analysis

If you use Elasticsearch with the manage_index_templates privilege, an attacker could exploit this to crash nodes by registering multiple template resources. This causes downtime, data unavailability, and potential service disruption for applications relying on Elasticsearch.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing service disruptions due to denial of service. GDPR requires data availability, and HIPAA mandates system reliability for protected health information. A denial of service could violate these requirements.

Mitigation Strategies

Restrict the manage_index_templates cluster privilege to trusted users only. Monitor heap usage and set up alerts for abnormal memory consumption. Apply the latest Elasticsearch security patches if available.

Hi! I’m here to help you understand CVE-2026-102411. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70