Is CVE-2026-102411 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102411 being exploited in the wild.

How severe is CVE-2026-102411?

Medium severity, with a CVSS score of 6.5, published 6 October 2026.

Which products and versions are affected?

Elasticsearch 8.0.0 through 8.19.22; 9.0.0 through 9.4.6; 9.5.0 through 9.5.2.

Is there a fix for CVE-2026-102411?

Yes: fixed in Elasticsearch 8.19.23, 9.4.7, 9.5.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102411 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-102411?

Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102411: Elastic Elasticsearch denial of service via unthrottled resource allocation

CVE-2026-102411 · Severity: medium · CVSS 6.5 · Published 2026-10-06

Elasticsearch is a widely-used search and analytics engine used for indexing and querying large volumes of data. An authenticated user with index template management privileges can exploit a flaw in memory handling to crash Elasticsearch nodes by exhausting heap memory, causing service outages. The attacker registers multiple index templates within individual size limits but retrieves them together to trigger an out-of-memory condition.

Technologies: Elasticsearch. Vendors: Elastic.

Quick answers

Is CVE-2026-102411 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102411 being exploited in the wild.
How severe is CVE-2026-102411?: Medium severity, with a CVSS score of 6.5, published 6 October 2026.
Which products and versions are affected?: Elasticsearch 8.0.0 through 8.19.22; 9.0.0 through 9.4.6; 9.5.0 through 9.5.2.
Is there a fix for CVE-2026-102411?: Yes: fixed in Elasticsearch 8.19.23, 9.4.7, 9.5.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102411 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-102411?: Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Elasticsearch 8.19.23, 9.4.7, 9.5.3

Technical details

CWE-770: Allocation of Resources Without Limits or Throttling. The vulnerability exists in Elasticsearch's metadata handling for index templates, where individual resources are size-limited but aggregate memory usage of multiple resources is not constrained. An authenticated attacker holding the manage_index_templates cluster privilege can register multiple templates and retrieve them in batch, causing all metadata values to materialize simultaneously in heap memory, exhausting available RAM and forcing node failure with an out-of-memory error.

Affected products

Elastic Elasticsearch 8.0.0 through 8.19.22; 9.0.0 through 9.4.6; 9.5.0 through 9.5.2

Timeline

2026-10-06: disclosed

References

https://discuss.elastic.co/t/elasticsearch-9-4-7-9-5-3-8-19-23-security-update-esa-2026-192/390865

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.