# CVE-2026-102411: Elastic Elasticsearch denial of service via unthrottled resource allocation

Source: https://junglewise.ai/threats/cve-2026-102411-allocation-of-resources-without-limits-or-throttling-cwe-770-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-102411 · Severity: medium · CVSS 6.5 · Published 2026-10-06

Elasticsearch is a widely-used search and analytics engine used for indexing and querying large volumes of data. An authenticated user with index template management privileges can exploit a flaw in memory handling to crash Elasticsearch nodes by exhausting heap memory, causing service outages. The attacker registers multiple index templates within individual size limits but retrieves them together to trigger an out-of-memory condition.

Technologies: [Elasticsearch](https://junglewise.ai/threats/technologies/elasticsearch). Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic).

## Quick answers

**Is CVE-2026-102411 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102411 being exploited in the wild.

**How severe is CVE-2026-102411?** Medium severity, with a CVSS score of 6.5, published 6 October 2026.

**Which products and versions are affected?** Elasticsearch 8.0.0 through 8.19.22; 9.0.0 through 9.4.6; 9.5.0 through 9.5.2.

**Is there a fix for CVE-2026-102411?** Yes: fixed in Elasticsearch 8.19.23, 9.4.7, 9.5.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102411 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-102411?** Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Elasticsearch 8.19.23, 9.4.7, 9.5.3

## Technical details

CWE-770: Allocation of Resources Without Limits or Throttling. The vulnerability exists in Elasticsearch's metadata handling for index templates, where individual resources are size-limited but aggregate memory usage of multiple resources is not constrained. An authenticated attacker holding the manage_index_templates cluster privilege can register multiple templates and retrieve them in batch, causing all metadata values to materialize simultaneously in heap memory, exhausting available RAM and forcing node failure with an out-of-memory error.

## Affected products

- Elastic Elasticsearch 8.0.0 through 8.19.22; 9.0.0 through 9.4.6; 9.5.0 through 9.5.2

## Timeline

- 2026-10-06: disclosed

## References

- [https://discuss.elastic.co/t/elasticsearch-9-4-7-9-5-3-8-19-23-security-update-esa-2026-192/390865](https://discuss.elastic.co/t/elasticsearch-9-4-7-9-5-3-8-19-23-security-update-esa-2026-192/390865)

## Related threats

- [Elasticsearch denial of service in phonetic analysis encoders](https://junglewise.ai/threats/cve-2026-115715-allocation-of-resources-without-limits-or-throttling-cwe-770-in)
- [Elasticsearch cache information disclosure via field-level security bypass](https://junglewise.ai/threats/cve-2026-115710-use-of-cache-containing-sensitive-information-cwe-524-in)
- [Elasticsearch incorrect authorization in field-level security](https://junglewise.ai/threats/cve-2026-115298-incorrect-authorization-cwe-863-in-elasticsearch-can-lead-to)
- [Elasticsearch uncontrolled recursion denial of service](https://junglewise.ai/threats/cve-2026-115290-uncontrolled-recursion-cwe-674-in-elasticsearch-can-lead-to)
- [Elasticsearch authorization bypass in cross-cluster search](https://junglewise.ai/threats/cve-2026-103009-authorization-bypass-through-user-controlled-key-cwe-639-in)