{"id":"CVE-2026-102411","summary":"Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service","details":"Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, but does not limit the total memory used when multiple such resources are retrieved together. A user holding the *manage_index_templates* cluster privilege can register multiple resources each within the individual limit. Retrieving them together materializes all of their metadata values in memory at once, exhausting available heap and causing the affected node to fail with an out-of-memory error, resulting in a denial of service.","modified":"2026-10-11T07:04:58.908454808Z","published":"2026-10-06T19:31:43.529Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"8.0.0"},{"last_affected":"8.19.22"},{"introduced":"9.0.0"},{"last_affected":"9.4.6"},{"introduced":"9.5.0"},{"last_affected":"9.5.2"}],"source":"AFFECTED_FIELD"}],"cna_assigner":"elastic","cwe_ids":["CWE-770"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102411.json"},"references":[{"type":"WEB","url":"https://discuss.elastic.co/t/elasticsearch-9-4-7-9-5-3-8-19-23-security-update-esa-2026-192/390865"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102411.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102411"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/elasticsearch","events":[{"introduced":"1b6a7ece17463df5ff54a3e1302d825889aa1161"},{"fixed":"6940e499f8a38841809b8e295a20c6421c95d9e4"},{"introduced":"112859b85d50de2a7e63f73c8fc70b99eea24291"},{"fixed":"9093bd876e86f531329aad3704ec9ab607c909c8"},{"introduced":"8d4246a64bc255212407b1b313fe402391299c88"},{"fixed":"367ec317ec5f668dd864d41be06052a567102fec"}],"database_specific":{"extracted_events":[{"introduced":"8.0.0"},{"fixed":"8.19.23"},{"introduced":"9.0.0"},{"fixed":"9.4.7"},{"introduced":"9.5.0"},{"fixed":"9.5.3"}],"source":"CPE_RANGE","cpe":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*"}}],"versions":["v9.5.2","v9.5.1","v9.5.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102411.json","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4","target":{"file":"server/src/main/java/org/elasticsearch/search/SearchService.java","function":"findReaderContext"},"deprecated":false,"digest":{"function_hash":"274518215284647076646986422064463465829","length":88},"id":"CVE-2026-102411-1ec51e31","signature_type":"Function"},{"id":"CVE-2026-102411-2f0f1493","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4","target":{"file":"server/src/test/java/org/elasticsearch/search/SearchServiceSingleNodeTests.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["34716596029123053891622503665744975522","136597128455756969875199639982053850246","33114870576535538868732528378817237038","24535752106006161089390341154763835781","32025328027204743683123658321447485435","237294143449399198062954492160161008815","60108391526600641876635922575949266596","221188683218490460210398357043319878397"]}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4","target":{"function":"executeQueryPhase","file":"server/src/main/java/org/elasticsearch/search/SearchService.java"},"deprecated":false,"digest":{"function_hash":"32219766351204362524735889854234264931","length":1399},"id":"CVE-2026-102411-3782cdc9"},{"id":"CVE-2026-102411-3ee61f2a","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4","target":{"function":"executeRankFeaturePhase","file":"server/src/main/java/org/elasticsearch/search/SearchService.java"},"deprecated":false,"digest":{"function_hash":"235327354171772893933086404919646769443","length":1292}},{"target":{"file":"server/src/main/java/org/elasticsearch/search/SearchService.java","function":"executeQueryPhase"},"deprecated":false,"digest":{"length":1652,"function_hash":"274241121916035881124943068305157393030"},"id":"CVE-2026-102411-6f2d8738","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4"},{"source":"https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4","target":{"file":"server/src/main/java/org/elasticsearch/search/SearchService.java"},"deprecated":false,"digest":{"line_hashes":["125383642980696038228423249885037087907","261471238883245253485251707982464042313","51524100471773408154896944447657589948","150723850866291844801996221671924990416","207421814369850706103188983726593940012","166638929813184654751768272241137507630","95835334912135568405368318097647697053","11612101662951389857776078248968042366","207179221818971715728185224961636436712","313874217088966083471250075545492088509","6338586734438517569513032664491806449","272623717981358433156931308570258987872","250519116710560595780417356042205004283","147033079518902172069276829288106239716","232897152212846557099322254530811851848","44965062797649795644289816277533058107","256310236651437823324933622355259162656","69436595654197042399739765684566601412","235333455269776207681922667062920513645","119654270185562309618377567339508536991","104528801602712543598070207070642880404","60728570034104267633092155969410265256","305618196026062664978599614252660928550","251449639069083971095559418835930320627","121666292089624949203915345112863555426","201091802252295406525026940957880463055","295569246277314332311962311211454875241","184403754202836771555674635759170971452","18563896754100733089287727373632305962","159887752230878929646097633553909623864","148503729247859112451805457840207032476","244450234615412336555037175802376151754","181889403959156383495359725209580327736","17089704399309520885335187793594783096","302749772054223353303233085400080146587","85384856571905711248474779555553173266","270211841947528204804027033771640011839","162938967126245291415434870730801502108","170349590110038710594840105573559665545","234755445075301857904488272943416829659","63010649486780191677521355742600849790","324721074450501520324696603013574532318","163849468510296036997020811893318968050","99425507450331617689097946060610002120","138512551789884651998896184195254595579","65925264456461681032564025634813139461","209313892152408238957810889544936258562","225048483034576615624641398918704791145","313588144374663490471362910627622796992","8136684546292520340104302962964267873","40871157852258026916726652046562781890","162820149852636856132339780010618230462","158612464768460328536137711547305583511","33126129005482477766989129895442561321","17493167302562197822319584750814321714","148993112694963710266097750401657888597","233484244068601829730549177364862208163","226123353023713216192924934405342343346","192873641240662247147599811365702116313"],"threshold":0.9},"id":"CVE-2026-102411-92955005","signature_type":"Line","signature_version":"v1"},{"target":{"function":"executeFetchPhase","file":"server/src/main/java/org/elasticsearch/search/SearchService.java"},"deprecated":false,"digest":{"function_hash":"86672828041889460988485494404978863879","length":1547},"id":"CVE-2026-102411-aa500e53","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4","target":{"file":"server/src/internalClusterTest/java/org/elasticsearch/action/search/PointInTimeIT.java"},"deprecated":false,"digest":{"line_hashes":["250013348203320901709327575092186631989","136736397440448403411052668355334902910","32079631131251667747258365325591770630","279338845067386713446719130847193884756","62569786264280762641421666368736817258","285783017263267208960745337074099265923","200351550324051570850358398506880628018","67430965804828112084137267484606316507","4197170716383299639952075926883047836","45557402670247067755892574231513103835","293861044391672734879588009163626417005","192185246724442387903294071867609776005","20339230060257156808559960575204347382","129937661334763822309905753508217697407","320834131378315414869823519671573111780","237590822914800589904946117160349354191","28411078344575547472561388731524586345","284626241710301775182826724147561956414","279120247205670146858886130607970997824","47517463461575784382003141253476483887","288671565162871039380462974768299334301","96242774579101872059738612669764242573","186455008403005080913340749458793035246","333602489265304513498139927960045489303"],"threshold":0.9},"id":"CVE-2026-102411-aae647a1"},{"target":{"file":"server/src/main/java/org/elasticsearch/search/SearchService.java","function":"findReaderContext"},"deprecated":false,"digest":{"function_hash":"175610603023598627067230817325853111696","length":501},"id":"CVE-2026-102411-e56db8ce","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4"},{"digest":{"function_hash":"313574142537140578542602811868543830438","length":889},"id":"CVE-2026-102411-e66282a2","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4","target":{"function":"createOrGetReaderContext","file":"server/src/main/java/org/elasticsearch/search/SearchService.java"},"deprecated":false},{"target":{"file":"server/src/main/java/org/elasticsearch/search/SearchService.java","function":"executeFetchPhase"},"deprecated":false,"digest":{"length":1433,"function_hash":"110548918634932471290745783473457952077"},"id":"CVE-2026-102411-e72e7bac","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/6940e499f8a38841809b8e295a20c6421c95d9e4"}],"vanir_signatures_modified":"2026-10-11T07:04:58Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}