CVE-2026-102404

Elasticsearch has an uncontrolled resource consumption flaw (CWE-400) in which a low-privileged authenticated user can force excessive memory allocation during query processing. A specially crafted query makes the query engine grow memory without bound until the node runs out of memory and terminates. The same condition can be triggered repeatedly, including through queries stored in shared resources, so a cluster can be kept unavailable. Only availability is affected; confidentiality and integrity are not. It is not listed in CISA KEV and no public proof-of-concept is known.

What to do: Apply the Elasticsearch security update Elastic publishes for this issue on every node in the cluster as soon as it is available for your release line. Until then, limit which authenticated users can run or share queries, review saved searches and other shared resources for untrusted query content, and alert on repeated node out-of-memory crashes or abrupt process exits.