Is CVE-2026-103005 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-103005 being exploited in the wild.

How severe is CVE-2026-103005?

Medium severity, with a CVSS score of 6.5, published 6 October 2026.

Which products and versions are affected?

Elasticsearch 8.12.0-8.19.22, 9.0.0-9.3.8, 9.4.0-9.4.7, 9.5.0-9.5.4.

Is there a fix for CVE-2026-103005?

Yes: fixed in Elasticsearch 8.19.23, 9.4.8, 9.5.5. Until then: No workarounds are available; users must upgrade to a patched version immediately. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-103005 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-103005?

Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-103005: Elasticsearch memory exhaustion via oversized connector description

CVE-2026-103005 · Severity: medium · CVSS 6.5 · Published 2026-10-06

Elasticsearch, a widely-used search and analytics engine, contains a vulnerability that allows authenticated users with connector management privileges to crash a cluster node by creating connectors with extremely large description fields. An attacker with these privileges can exhaust the server's memory heap, causing the node to crash and disrupting search and logging services that depend on the cluster.

Technologies: Elasticsearch. Vendors: Elastic.

Quick answers

Is CVE-2026-103005 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-103005 being exploited in the wild.
How severe is CVE-2026-103005?: Medium severity, with a CVSS score of 6.5, published 6 October 2026.
Which products and versions are affected?: Elasticsearch 8.12.0-8.19.22, 9.0.0-9.3.8, 9.4.0-9.4.7, 9.5.0-9.5.4.
Is there a fix for CVE-2026-103005?: Yes: fixed in Elasticsearch 8.19.23, 9.4.8, 9.5.5. Until then: No workarounds are available; users must upgrade to a patched version immediately. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-103005 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-103005?: Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Elasticsearch 8.19.23, 9.4.8, 9.5.5

No workarounds are available; users must upgrade to a patched version immediately.

Technical details

A memory allocation vulnerability (CWE-789) in Elasticsearch's Connector API fails to validate the size of the `description` field, allowing an authenticated attacker to trigger excessive memory allocation. The attack requires connector management privileges and network access to the Elasticsearch cluster; when a malicious connector resource is created and accessed, the node allocates unbounded memory until heap exhaustion causes a denial of service.

Affected products

Elastic Elasticsearch 8.12.0-8.19.22, 9.0.0-9.3.8, 9.4.0-9.4.7, 9.5.0-9.5.4

Timeline

2026-10-06: disclosed: CVE-2026-103005 publicly disclosed

References

https://discuss.elastic.co/t/elasticsearch-8-19-23-9-4-8-9-5-5-security-update-esa-2026-195/390869

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.