CVE-2026-102404: Elastic Elasticsearch

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can submit a specially crafted query that causes uncontrolled memory growth in the query processing engine, resulting in an out-of-memory condition that terminates the Elasticsearch node. The condition can be triggered repeatedly, including by queries embedded in shared resources, causing persistent cluster unavailability.

Affected products

• Elastic Elasticsearch: from 8.0.0, up to and including 8.19.22; from 9.0.0, up to and including 9.4.7; from 9.5.0, up to and including 9.5.4

Published 2026-10-06. Last modified 2026-10-07.