Is CVE-2026-102404 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102404 being exploited in the wild.

How severe is CVE-2026-102404?

Medium severity, with a CVSS score of 6.5, published 6 October 2026.

Which products and versions are affected?

Elasticsearch 8.0.0–8.19.22, 9.0.0–9.4.7, 9.5.0–9.5.4.

Is there a fix for CVE-2026-102404?

Yes: fixed in Elasticsearch 8.19.23, 9.4.8, 9.5.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102404 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-102404?

Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102404: Elasticsearch uncontrolled resource consumption denial of service

CVE-2026-102404 · Severity: medium · CVSS 6.5 · Published 2026-10-06

Elasticsearch, a search and analytics engine widely used to index and query large datasets, contains a flaw that allows authenticated users to crash nodes by submitting malicious queries. An attacker with valid credentials can repeatedly trigger an out-of-memory condition, rendering the entire cluster unavailable and disrupting services that depend on search and log analytics.

Technologies: Elasticsearch. Vendors: Elastic.

Quick answers

Is CVE-2026-102404 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102404 being exploited in the wild.
How severe is CVE-2026-102404?: Medium severity, with a CVSS score of 6.5, published 6 October 2026.
Which products and versions are affected?: Elasticsearch 8.0.0–8.19.22, 9.0.0–9.4.7, 9.5.0–9.5.4.
Is there a fix for CVE-2026-102404?: Yes: fixed in Elasticsearch 8.19.23, 9.4.8, 9.5.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102404 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-102404?: Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Elasticsearch 8.19.23, 9.4.8, 9.5.5

Technical details

An authenticated user can submit a specially crafted ES|QL query that causes uncontrolled memory allocation in the query processing engine, triggering an out-of-memory condition that terminates the node. The attack requires network access and valid authentication credentials. Since queries can be embedded in shared resources, the denial of service can persist across multiple triggerings without manual intervention, affecting all deployments with authenticated ES|QL query execution enabled.

Affected products

Elastic Elasticsearch 8.0.0–8.19.22, 9.0.0–9.4.7, 9.5.0–9.5.4

Timeline

2026-10-06: disclosed

References

https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-185/390859

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.