CVE-2026-102404
Description
A flaw was found in Elasticsearch. An authenticated remote attacker with low privileges can submit a specially crafted query to the query processing engine, triggering excessive memory allocation. This uncontrolled memory growth leads to an out-of-memory crash that terminates the service node, resulting in a Denial of Service (DoS) and cluster unavailability.
Statement
This vulnerability is rated as Moderate because exploitation requires valid credentials to execute search requests and is constrained to causing a denial of service without compromising data integrity or confidentiality. In typical Red Hat deployments, access to search endpoints is confined to internal platform services and authenticated users within private networks rather than exposed publicly. While an authenticated client with query privileges can trigger an out-of-memory crash on affected nodes, the issue cannot be leveraged to gain unauthorized system access or execute arbitrary code.
Mitigation
Restrict network exposure by limiting access to the Elasticsearch service to trusted internal networks and authorized hosts using host-level firewalling or container network policies.
On hosts utilizing firewalld, restrict traffic on the service port (TCP port 9200) to trusted IP addresses:
firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_CIDR>
firewall-cmd --permanent --remove-port=9200/tcp
firewall-cmd --reload
In OpenShift or Kubernetes environments, apply NetworkPolicies to restrict ingress traffic to the Elasticsearch pods, permitting communication only from trusted application namespaces. Additionally, restrict query execution privileges using role-based access control so that untrusted accounts cannot execute arbitrary queries.
Caveats: Network filtering and access restrictions prevent untrusted network actors from submitting queries, but authenticated trusted accounts can still trigger the vulnerability. Reloading firewall rules or applying network policies may cause brief connection drops for active sessions.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
