CVE-2026-102411: Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, but does not limit the total memory used when multiple such resources are retrieved together. A user holding the manageindextemplates cluster privilege can register multiple resources each within the individual limit. Retrieving them together materializes all of their metadata values in memory at once, exhausting available heap and causing the affected node to fail with an out-of-memory error, resulting in a denial of service.
Other sources
Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What level of access is required to trigger this issue?
An attacker must hold the manage_index_templates cluster privilege. They can create multiple template resources whose individual metadata values remain within Elasticsearch's per-resource size limit.
What is the operational impact if exploitation succeeds?
Retrieving the crafted resources together can materialize all of their metadata in memory at once. This can exhaust heap on the affected node, cause an out-of-memory failure, and deny service.