Skip to content
fr Sign in
6.5 Medium

CVE-2026-103005 Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive…

Description

Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an excessively large `description` field are created and subsequently accessed, exhausting available heap memory and crashing the affected node.

Affected products and versions

Product Affected versions Fixed in
Elasticsearch 9.5 9.5.0 → 9.5.4 No fix stated
Elasticsearch 9.4 9.4.0 → 9.4.7 No fix stated
Elasticsearch 9.0 9.0.0 → 9.3.8 No fix stated
Elasticsearch 8.12 8.12.0 → 8.19.22 No fix stated

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Elasticsearch

The 91 CVEs of Elasticsearch →
CVE-2026-115715 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a… 6.5 Medium CVE-2026-115710 Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and… 4.2 Medium CVE-2026-115298 Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not… 4.3 Medium CVE-2026-115290 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads… 7.5 High
Track this CVE