Denial of Service Vulnerability in Elasticsearch by Elastic

CVE-2026-102404

What is CVE-2026-102404?

A denial of service vulnerability exists in Elasticsearch due to uncontrolled resource consumption. This issue allows low-privileged authenticated users to submit specially crafted queries that provoke excessive memory allocation in the query processing engine. As a result, Elasticsearch nodes may experience out-of-memory conditions, which can lead to node termination and affect the overall availability of the cluster. This vulnerability can persistently disrupt service through repeated triggering, emphasizing the need for immediate action to secure affected versions.

References