CVE-2026-102404: Elasticsearch DoS Vulnerability

CVE-2026-102404 Overview

CVE-2026-102404 is an uncontrolled resource consumption vulnerability [CWE-400] in Elasticsearch. A low-privileged authenticated user can submit a specially crafted query that triggers uncontrolled memory growth in the query processing engine. The resulting out-of-memory condition terminates the affected Elasticsearch node.

The condition can be triggered repeatedly. Attackers can also embed the malicious query in shared resources such as saved searches or dashboards, extending the impact to any user or process that loads them. This produces persistent cluster unavailability until administrators intervene.

Critical Impact
An authenticated attacker with minimal privileges can crash Elasticsearch nodes on demand, causing sustained denial of service across the cluster.

Affected Products

Elasticsearch 8.19.x (fixed in 8.19.23 per advisory ESA-2026-185)
Elasticsearch 9.4.x (fixed in 9.4.8 per advisory ESA-2026-185)
Elasticsearch 9.5.x (fixed in 9.5.5 per advisory ESA-2026-185)

Discovery Timeline

2026-10-06 - CVE-2026-102404 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-102404

Vulnerability Analysis

The vulnerability resides in the Elasticsearch query processing engine. When a specially crafted query is parsed and executed, the engine allocates memory without enforcing bounds on structure size, nesting depth, or intermediate result volume. Memory consumption grows until the Java Virtual Machine (JVM) heap is exhausted.

Once the heap is exhausted, the node terminates with an out-of-memory error. If the query is persisted in shared assets such as saved searches, visualizations, or scheduled jobs, every subsequent load reproduces the fault. This converts a single malicious submission into recurring cluster-wide downtime.

The attack is network-reachable and requires only low-privileged authentication. No user interaction is needed, and the attacker does not need to compromise confidentiality or integrity to achieve the impact. Availability is the sole dimension affected, but the impact is high because the cluster can be driven into a crash loop.

Root Cause

The root cause is missing or insufficient resource limits during query processing. The engine does not cap intermediate allocations relative to available heap, allowing a single request to consume all addressable memory.

Attack Vector

An attacker authenticates to the Elasticsearch REST API with any account that holds search privileges. The attacker then issues the crafted query to a search or aggregation endpoint. The targeted coordinating node allocates memory until the JVM terminates. Repeating the request across nodes propagates the outage to the full cluster.

No verified public exploit code is available. Technical details are described in Elastic Security Update ESA-2026-185.

Detection Methods for CVE-2026-102404

Indicators of Compromise

Repeated OutOfMemoryError entries in Elasticsearch node logs correlated with search or aggregation requests.
Unexpected node restarts or cluster state transitions to red shortly after a specific user submits a query.
Saved searches, dashboards, or scheduled reports that consistently crash the node when loaded.

Detection Strategies

Correlate JVM heap pressure metrics with the audit log of the user that issued the most recent _search or _async_search request before a crash.
Alert on nodes transitioning out of the cluster within a short window of a single authenticated query identifier.
Review saved objects for queries with unusually deep nesting, large terms lists, or expensive aggregations.

Monitoring Recommendations

Enable Elasticsearch audit logging and ship events to a centralized analytics platform for correlation with node health telemetry.
Track JVM old-generation heap usage and garbage collection duration per node, with thresholds that trigger before OOM.
Monitor cluster health, unassigned shards, and node join or leave events for patterns consistent with crash loops.

How to Mitigate CVE-2026-102404

Immediate Actions Required

Upgrade to Elasticsearch 8.19.23, 9.4.8, or 9.5.5 as documented in advisory ESA-2026-185.
Audit saved searches, dashboards, and scheduled jobs for queries that have caused node crashes and remove or rewrite them.
Review user roles and remove search privileges from accounts that do not require them.

Patch Information

Elastic has released fixed versions in advisory ESA-2026-185. Patched releases are Elasticsearch 8.19.23, 9.4.8, and 9.5.5. Apply the patch that matches your deployed minor version and perform a rolling restart.

Workarounds

Restrict search API access to trusted roles until patches are applied.
Place Elasticsearch behind a reverse proxy that enforces request size, timeout, and rate limits.
Increase JVM heap and configure circuit breakers (indices.breaker.total.limit, indices.breaker.request.limit) conservatively to reduce blast radius, understanding this is partial mitigation only.

bash

# Configuration example: tighten request circuit breaker in elasticsearch.yml
indices.breaker.total.use_real_memory: true
indices.breaker.total.limit: 70%
indices.breaker.request.limit: 40%
indices.breaker.fielddata.limit: 30%