CVE-2026-102411

Elasticsearch: denial of service

Risk score: 44/100
CVSS: 6.5 v3.1
Exploit chance (30 days): 0.3%
Published: 6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, but does not limit the total memory used when multiple such …
Affected: Elasticsearch
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Elasticsearch: Yellow, plan it in. Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator dele…

The flaws

CVE-2026-102411: Denial of service (CVSS 6.5 · EPSS 0%)
CVE-2026-103007: Incorrect authorisation can lead to privilege escalation (CVSS 7.2 · EPSS 0%)
CVE-2026-82294: Denial of service (CVSS 6.5 · EPSS 0%)
CVE-2026-82300: Denial of service (CVSS 6.5 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Elasticsearch

Where it stands

No known exploitation

Connects to

Same weakness: Denial of service (CWE-770). 202 other warnings in 30 days
Same product: Earlier Elasticsearch warnings. 13 in the last 90 days

Why it is Yellow

CVSS 6.5 medium

References

https://discuss.elastic.co/t/elasticsearch-9-4-7-9-5-3-8-19-23-security-update-esa-2026-192/390865

Original description

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, but does not limit the total memory used when multiple such resources are retrieved together. A user holding the *manage_index_templates* cluster privilege can register multiple resources each within the individual limit. Retrieving them together materializes all of their metadata values in memory at once, exhausting available heap and causing the affected node to fail with an out-of-memory error, resulting in a denial of service.

Last activity 6 Oct 2026. Patch Forecast updates every hour.