CVE-2026-103005: Elasticsearch Memory Exhaustion DOS Vulnerability

CVE-2026-103005 Overview

CVE-2026-103005 is a memory allocation vulnerability in Elasticsearch tracked under [CWE-789: Memory Allocation with Excessive Size Value]. An authenticated user with connector management privileges can cause the cluster to allocate unbounded heap memory. The attack uses connector resources containing an excessively large description field. When the connector is subsequently accessed, memory exhaustion crashes the affected node.

The issue aligns with [CAPEC-130: Excessive Allocation]. Elastic published a fix in Elasticsearch versions 8.19.23, 9.4.8, and 9.5.5 through advisory ESA-2026-195.

Critical Impact
An authenticated attacker with connector management privileges can crash an Elasticsearch node by exhausting heap memory, disrupting cluster availability and search operations.

Affected Products

Elasticsearch 8.x prior to 8.19.23
Elasticsearch 9.4.x prior to 9.4.8
Elasticsearch 9.5.x prior to 9.5.5

Discovery Timeline

2026-10-06 - CVE-2026-103005 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-103005

Vulnerability Analysis

The vulnerability exists in Elasticsearch's connector management subsystem. Connectors are resources used to integrate external data sources with the cluster. Each connector carries metadata fields including a description string.

Elasticsearch does not enforce an upper bound on the size of the description field when a connector is created. An authenticated user with connector management privileges can submit a connector containing a very large description value. On subsequent access, the server allocates heap memory proportional to the stored field size. The allocation exhausts the Java Virtual Machine (JVM) heap and crashes the node.

The flaw affects availability only. Confidentiality and integrity of indexed data are not impacted. The crash halts search and ingest operations until the node restarts.

Root Cause

The root cause is missing input length validation on the connector description field during create and update operations. Without an enforced maximum size, the field acts as a vector for uncontrolled heap allocation when read operations materialize the value in memory.

Attack Vector

Exploitation requires network access to the Elasticsearch REST API and authenticated credentials with connector management privileges. The attacker creates or updates a connector with an oversized description field, then triggers any operation that reads the connector back. Repeated requests against multiple nodes can propagate the outage across the cluster.

No code example is included because no verified public proof-of-concept is available. Refer to the Elastic Discuss Security Update ESA-2026-195 for vendor details.

Detection Methods for CVE-2026-103005

Indicators of Compromise

Repeated OutOfMemoryError entries in Elasticsearch node logs tied to connector read operations.
Unexpected node crashes or JVM heap dumps generated shortly after _connector API calls.
Connector documents in the .elastic-connectors* system indices containing abnormally large description fields.

Detection Strategies

Audit the Elasticsearch audit log for POST /_connector and PUT /_connector/{id} requests, flagging payloads exceeding a defined size threshold.
Correlate authenticated API activity with node heap utilization spikes to identify suspicious connector operations.
Review role mappings to enumerate accounts with manage_connector or equivalent cluster privileges.

Monitoring Recommendations

Alert on JVM heap usage exceeding 85 percent sustained over short intervals on data and coordinating nodes.
Monitor cluster health transitions from green to red and correlate with connector API traffic.
Track node restart counts and crash dumps as part of availability baselines.

How to Mitigate CVE-2026-103005

Immediate Actions Required

Upgrade Elasticsearch to version 8.19.23, 9.4.8, or 9.5.5 as applicable to your deployment.
Review and reduce the number of accounts holding connector management privileges to the minimum required.
Inspect existing connectors and remove or truncate entries with oversized description fields.

Patch Information

Elastic released fixed versions 8.19.23, 9.4.8, and 9.5.5 under advisory ESA-2026-195. Patch notes and download links are available via the Elastic Discuss Security Update.

Workarounds

Restrict connector management privileges to a small set of trusted service accounts until patching is complete.
Place a reverse proxy or API gateway in front of the Elasticsearch REST API and enforce a request body size limit on _connector endpoints.
Enable Elasticsearch audit logging to capture connector create and update operations for forensic review.

bash

# Example: enforce a request body size limit at an NGINX reverse proxy
location /_connector {
    client_max_body_size 64k;
    proxy_pass https://elasticsearch-cluster:9200;
}