CVE-2026-102404CWE-400denial-of-service

CVE-2026-102404

Medium · published October 7, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
22.5
In the wild
Unconfirmed
What it is

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query processing engine, resulting in an out-of-memory condition that terminates the Elasticsearch node. The condition can be triggered repeatedly, including by queries embedded in shared resources, causing persistent cluster unavailability.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00309 · 22.5th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-10-07T00:17Z
Affected products (3)
ProductVersionsFixed in
elastic/elasticsearch≥ 8.0.0, < 8.19.238.19.23
elastic/elasticsearch≥ 9.0.0, < 9.4.89.4.8
elastic/elasticsearch≥ 9.5.0, < 9.5.59.5.5
References (1)
https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-185/390859 · [email protected]
EPSS history
Timeline
  • 08 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 06 OCT 19:31Z
    Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service
    cvelistv5