CVE-2026-102411: CWE-770 Allocation of Resources Without Limits or Throttling in Elastic Elasticsearch

This vulnerability (CWE-770) in Elasticsearch arises because while there is a size limit on the metadata field for each individual template resource, there is no limit on the total memory used when multiple such resources are retrieved together. A user with the manage_index_templates cluster privilege can exploit this by registering multiple resources within the individual limit. Retrieving all these resources at once causes all their metadata to be loaded into memory simultaneously, exhausting heap space and causing the node to fail with an out-of-memory error, leading to denial of service.

The impact is a denial of service condition on the affected Elasticsearch node due to heap exhaustion and out-of-memory errors. There is no impact on confidentiality or integrity, only availability is affected. The CVSS score is 6.5 (medium severity) with no confidentiality or integrity impact but high impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the manage_index_templates cluster privilege to trusted users only to prevent exploitation. Monitor resource usage when retrieving multiple template resources to avoid triggering excessive memory allocation.