CVE-2026-103005

Analyzed Analyzed - Analysis Complete

Memory Allocation Flaw in Elasticsearch Leads to DoS

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: Elastic

Description

Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an excessively large `description` field are created and subsequently accessed, exhausting available heap memory and crashing the affected node.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103005

EUVD

EUVD-2026-93935

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	From 9.4.0 (inc) to 9.4.8 (exc)
elastic	elasticsearch	From 9.5.0 (inc) to 9.5.5 (exc)
elastic	elasticsearch	From 8.12.0 (inc) to 8.19.23 (exc)
elastic	elasticsearch	From 9.0.0 (inc) to 9.3.8 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

This is a memory allocation vulnerability in Elasticsearch where an authenticated user with connector management privileges can cause excessive memory allocation by creating connector resources with an overly large description field. This leads to heap memory exhaustion and potential node crashes.

Detection Guidance

Detecting this vulnerability requires monitoring Elasticsearch for excessive memory allocation caused by large connector descriptions. Check Elasticsearch logs for heap memory exhaustion errors or crashes. Use Elasticsearch APIs like _nodes/stats to monitor heap usage and _cluster/allocation/explain to identify resource-heavy connectors. Look for nodes with unusually high memory consumption or frequent garbage collection pauses.

Impact Analysis

An attacker could exploit this to crash Elasticsearch nodes, causing denial of service. This disrupts search functionality, data availability, and may lead to service unavailability for users relying on Elasticsearch.

Compliance Impact

This vulnerability could impact compliance by causing service disruptions that violate availability requirements in GDPR or HIPAA. Downtime may lead to data processing delays or breaches of service level agreements.

Mitigation Strategies

Restrict authenticated users from creating connector resources with excessively large description fields. Monitor heap memory usage on Elasticsearch nodes for unusual spikes. Update Elasticsearch to the latest patched version if available.

Hi! I’m here to help you understand CVE-2026-103005. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70