Denial of Service Vulnerability in Elasticsearch by Elastic

CVE-2026-102411

What is CVE-2026-102411?

A vulnerability in Elasticsearch allows a user with the manage_index_templates privilege to trigger a Denial of Service. The issue arises from a lack of limits on the total memory used when multiple user-supplied metadata fields are retrieved simultaneously. While individual templates are subject to a size limit, retrieving several at once can cause significant memory exhaustion, leading to out-of-memory errors and service outages.

References