CVE-2026-102411

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-102411
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102411.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-102411
Downstream
AZL (1)
MINI (21)
Published
2026-10-06T19:31:43Z
Modified
2026-10-11T07:04:58Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
Details

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, but does not limit the total memory used when multiple such resources are retrieved together. A user holding the manage_index_templates cluster privilege can register multiple resources each within the individual limit. Retrieving them together materializes all of their metadata values in memory at once, exhausting available heap and causing the affected node to fail with an out-of-memory error, resulting in a denial of service.

Database specific 
{
    "cna_assigner": "elastic",
    "cwe_ids": [
        "CWE-770"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102411.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "8.0.0"
                },
                {
                    "last_affected": "8.19.22"
                },
                {
                    "introduced": "9.0.0"
                },
                {
                    "last_affected": "9.4.6"
                },
                {
                    "introduced": "9.5.0"
                },
                {
                    "last_affected": "9.5.2"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/elastic/elasticsearch

Affected ranges

Type
GIT
Repo
https://github.com/elastic/elasticsearch
Events
Introduced
1b6a7ece17463df5ff54a3e1302d825889aa1161
Fixed
6940e499f8a38841809b8e295a20c6421c95d9e4
Introduced
112859b85d50de2a7e63f73c8fc70b99eea24291
Fixed
9093bd876e86f531329aad3704ec9ab607c909c8
Introduced
8d4246a64bc255212407b1b313fe402391299c88
Fixed
367ec317ec5f668dd864d41be06052a567102fec
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.19.23"
        },
        {
            "introduced": "9.0.0"
        },
        {
            "fixed": "9.4.7"
        },
        {
            "introduced": "9.5.0"
        },
        {
            "fixed": "9.5.3"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v9.*
v9.5.0
v9.5.1
v9.5.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102411.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "274518215284647076646986422064463465829",
            "length": 88
        },
        "id": "CVE-2026-102411-1ec51e31",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/main/java/org/elasticsearch/search/SearchService.java",
            "function": "findReaderContext"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "34716596029123053891622503665744975522",
                "136597128455756969875199639982053850246",
                "33114870576535538868732528378817237038",
                "24535752106006161089390341154763835781",
                "32025328027204743683123658321447485435",
                "237294143449399198062954492160161008815",
                "60108391526600641876635922575949266596",
                "221188683218490460210398357043319878397"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-102411-2f0f1493",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/test/java/org/elasticsearch/search/SearchServiceSingleNodeTests.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "32219766351204362524735889854234264931",
            "length": 1399
        },
        "id": "CVE-2026-102411-3782cdc9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/main/java/org/elasticsearch/search/SearchService.java",
            "function": "executeQueryPhase"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "235327354171772893933086404919646769443",
            "length": 1292
        },
        "id": "CVE-2026-102411-3ee61f2a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/main/java/org/elasticsearch/search/SearchService.java",
            "function": "executeRankFeaturePhase"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "274241121916035881124943068305157393030",
            "length": 1652
        },
        "id": "CVE-2026-102411-6f2d8738",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/main/java/org/elasticsearch/search/SearchService.java",
            "function": "executeQueryPhase"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "125383642980696038228423249885037087907",
                "261471238883245253485251707982464042313",
                "51524100471773408154896944447657589948",
                "150723850866291844801996221671924990416",
                "207421814369850706103188983726593940012",
                "166638929813184654751768272241137507630",
                "95835334912135568405368318097647697053",
                "11612101662951389857776078248968042366",
                "207179221818971715728185224961636436712",
                "313874217088966083471250075545492088509",
                "6338586734438517569513032664491806449",
                "272623717981358433156931308570258987872",
                "250519116710560595780417356042205004283",
                "147033079518902172069276829288106239716",
                "232897152212846557099322254530811851848",
                "44965062797649795644289816277533058107",
                "256310236651437823324933622355259162656",
                "69436595654197042399739765684566601412",
                "235333455269776207681922667062920513645",
                "119654270185562309618377567339508536991",
                "104528801602712543598070207070642880404",
                "60728570034104267633092155969410265256",
                "305618196026062664978599614252660928550",
                "251449639069083971095559418835930320627",
                "121666292089624949203915345112863555426",
                "201091802252295406525026940957880463055",
                "295569246277314332311962311211454875241",
                "184403754202836771555674635759170971452",
                "18563896754100733089287727373632305962",
                "159887752230878929646097633553909623864",
                "148503729247859112451805457840207032476",
                "244450234615412336555037175802376151754",
                "181889403959156383495359725209580327736",
                "17089704399309520885335187793594783096",
                "302749772054223353303233085400080146587",
                "85384856571905711248474779555553173266",
                "270211841947528204804027033771640011839",
                "162938967126245291415434870730801502108",
                "170349590110038710594840105573559665545",
                "234755445075301857904488272943416829659",
                "63010649486780191677521355742600849790",
                "324721074450501520324696603013574532318",
                "163849468510296036997020811893318968050",
                "99425507450331617689097946060610002120",
                "138512551789884651998896184195254595579",
                "65925264456461681032564025634813139461",
                "209313892152408238957810889544936258562",
                "225048483034576615624641398918704791145",
                "313588144374663490471362910627622796992",
                "8136684546292520340104302962964267873",
                "40871157852258026916726652046562781890",
                "162820149852636856132339780010618230462",
                "158612464768460328536137711547305583511",
                "33126129005482477766989129895442561321",
                "17493167302562197822319584750814321714",
                "148993112694963710266097750401657888597",
                "233484244068601829730549177364862208163",
                "226123353023713216192924934405342343346",
                "192873641240662247147599811365702116313"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-102411-92955005",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/main/java/org/elasticsearch/search/SearchService.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "86672828041889460988485494404978863879",
            "length": 1547
        },
        "id": "CVE-2026-102411-aa500e53",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/main/java/org/elasticsearch/search/SearchService.java",
            "function": "executeFetchPhase"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "250013348203320901709327575092186631989",
                "136736397440448403411052668355334902910",
                "32079631131251667747258365325591770630",
                "279338845067386713446719130847193884756",
                "62569786264280762641421666368736817258",
                "285783017263267208960745337074099265923",
                "200351550324051570850358398506880628018",
                "67430965804828112084137267484606316507",
                "4197170716383299639952075926883047836",
                "45557402670247067755892574231513103835",
                "293861044391672734879588009163626417005",
                "192185246724442387903294071867609776005",
                "20339230060257156808559960575204347382",
                "129937661334763822309905753508217697407",
                "320834131378315414869823519671573111780",
                "237590822914800589904946117160349354191",
                "28411078344575547472561388731524586345",
                "284626241710301775182826724147561956414",
                "279120247205670146858886130607970997824",
                "47517463461575784382003141253476483887",
                "288671565162871039380462974768299334301",
                "96242774579101872059738612669764242573",
                "186455008403005080913340749458793035246",
                "333602489265304513498139927960045489303"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-102411-aae647a1",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/internalClusterTest/java/org/elasticsearch/action/search/PointInTimeIT.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "175610603023598627067230817325853111696",
            "length": 501
        },
        "id": "CVE-2026-102411-e56db8ce",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/main/java/org/elasticsearch/search/SearchService.java",
            "function": "findReaderContext"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "313574142537140578542602811868543830438",
            "length": 889
        },
        "id": "CVE-2026-102411-e66282a2",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/main/java/org/elasticsearch/search/SearchService.java",
            "function": "createOrGetReaderContext"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "110548918634932471290745783473457952077",
            "length": 1433
        },
        "id": "CVE-2026-102411-e72e7bac",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4",
        "target": {
            "file": "server/src/main/java/org/elasticsearch/search/SearchService.java",
            "function": "executeFetchPhase"
        }
    }
]
vanir_signatures_modified 
"2026-10-11T07:04:58Z"