CVE-2026-102411

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Published

Oct 6, 2026, 7:31:43 PM UTC

Updated

Oct 6, 2026, 8:17:13 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.31% · Oct 25, 2026

A flaw was found in Elasticsearch. An authenticated user with index template management privileges can cause a Denial of Service (DoS) by registering multiple template resources and requesting them together. Although size limits exist for individual metadata entries, the system does not restrict cumulative memory consumption when retrieving multiple resources at once. This can exhaust available memory and cause the affected node to crash. elasticsearch: Elasticsearch: Denial of Service via excessive memory allocation during index template retrieval A moderate-impact denial of service vulnerability was found in Elasticsearch. An authenticated user who holds the manage_index_templates cluster privilege can register multiple index template resources whose user-supplied metadata each stay within the enforced per-resource size limit. When multiple such resources are retrieved together, Elasticsearch does not limit the total memory used to materialize their metadata values, so the combined retrieval can exhaust the node's available heap and cause the affected node to fail with an out-of-memory error, resulting in a denial of service. The flaw affects availability only, with no impact on confidentiality or integrity, and the Red Hat severity matches the upstream assessment (CVSS 3.1 score 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, Moderate). In Red Hat's scope, this flaw affects the community offerings for Elasticsearch (the Fedora and EPEL streams), which are tracked as affected, and a fix is being pursued for those streams. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.