Vulnerability in Elasticsearch

[ Description ]Official description

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, but does not limit the total memory used when multiple such resources are retrieved together. A user holding the *manage_index_templates* cluster privilege can register multiple resources each within the individual limit. Retrieving them together materializes all of their metadata values in memory at once, exhausting available heap and causing the affected node to fail with an out-of-memory error, resulting in a denial of service.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• CERT-FR7 Oct 2026CERTFR-2026-AVI-1276

  Multiple vulnerabilities in Elastic products Translated from French

  Multiple vulnerabilities have been discovered in Elastic products. Some of them allow an attacker to cause privilege escalation, a breach of data confidentiality and a security policy bypass.

  CVE-2026-102406CVE-2026-103006CVE-2026-102404+11 more CVEs
• BSI CERT-Bund6 Oct 2026WID-SEC-2026-3784

  Elasticsearch: Multiple vulnerabilities Translated from German

  CVE-2026-102404CVE-2026-103005CVE-2026-103006+7 more CVEs

[ References ]References

• discuss.elastic.co/t/elasticsearch-9-4-7-9-5-3-8-19-23-security-update-esa-2026-192/390865Vendor Advisory