CVE-2026-102404

Executive Summary

CVE-2026-102404 is an uncontrolled resource consumption vulnerability (CWE-400) in Elasticsearch that allows a low-privileged authenticated user to submit a specially crafted query which causes uncontrolled memory growth in the query processing engine. Successful exploitation drives an out-of-memory (OOM) condition that terminates the Elasticsearch node, and the trigger can be repeated—including via queries embedded in shared resources—to produce persistent cluster unavailability. Any organization running an exposed or broadly accessible Elasticsearch deployment where untrusted or low-privilege accounts exist is affected; no patch is presently available from tracked sources.

Technical Analysis

The vulnerability resides in the query processing engine of Elasticsearch. Per the published description, the flaw class is uncontrolled resource consumption (CWE-400), manifested through excessive allocation (CAPEC-130). A "specially crafted query" submitted by an authenticated low-privileged user causes memory growth that is not bounded by the engine before or during query execution, ultimately exhausting the JVM heap and triggering an out-of-memory termination of the node.

Several technical characteristics are notable:

1. Precondition — authentication, not authorization bypass. The attacker must be low-privileged but authenticated. The vulnerability is therefore not pre-auth remote code execution or an access-control bypass; it is an availability-focused abuse of normal query surfaces that a valid credential holder can reach. This materially raises the attack surface in multi-tenant clusters, shared logging platforms, and any deployment where read-only or index-scoped users are provisioned for third parties.

2. Trigger mechanism — allocation amplification. The description attributes the impact to "uncontrolled memory growth in the query processing engine." The specific query construct (for example, a shape, aggregation, or expansion pattern) is not disclosed in the available data. Attackers do not need memory-safety corruption; they exploit the absence of an effective resource ceiling on allocation during query evaluation.

3. Reusability and persistence. The description explicitly states the condition "can be triggered repeatedly, including by queries embedded in shared resources." This indicates that a single malicious or pathological query persisted into a shared artifact can serve as a recurring trigger without the attacker re-authenticating—every time the resource is executed, memory consumption recurs. This differentiates the CVE from a one-shot crash: the failure mode can become a self-renewing outage.

4. Node-level failure, cluster-level blast radius. OOM termination affects a single node first, but in a clustered topology the loss of a node degrades shard availability, can force shard reallocation and recovery traffic, and—if repeated or aimed at data/master-eligible nodes—can cascade into cluster-wide unavailability. The CVSS vector reflects this: availability impact is High (A:H) while confidentiality and integrity are None, and the attack is network-reachable (AV:N), low complexity (AC:L), with low privileges required (PR:L) and no user interaction (UI:N).

No public proof-of-concept, exploit code, or Nuclei template exists per the supplied data, and no affected version range or vendor fix is identified. All mechanics above are derived strictly from the CWE/CAPEC classification and the NVD description; additional query-level specificity is not available and is not inferred here.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class (CWE-400 / CAPEC-130) and the NVD description.

Step 1 — Reconnaissance / target identification. The attacker identifies an Elasticsearch deployment reachable over the network (commonly TCP/9200 for the HTTP API, and TCP/9300 for transport in older topologies). Banner and version fingerprinting via the HTTP layer confirms the product and build. The attacker then determines whether they hold, or can obtain, any valid low-privilege credential—e.g., a read-only or index-scoped account. Because the vulnerability requires authentication, credential acquisition (shared service accounts, leaked keys, over-provisioned application roles) is the primary reconnaissance objective rather than software version matching.

Step 2 — Triggering the flaw class. Using the authenticated session, the attacker submits a specially crafted query to the query processing engine. Consistent with CWE-400 / CAPEC-130, the query is designed to maximize allocation during processing rather than to return a large result set; the memory growth is uncontrolled by the engine. The exact query construct is not disclosed in the available data, so no specific DSL clause, aggregation type, or parameter name is asserted here.

Step 3 — Payload / execution method (class level). Execution is via the ordinary query submission interface available to the authenticated user. There is no memory corruption, injection, or code-execution step: the "payload" is the resource-intensive query itself. The attacker may iterate the query, time-box repetitions to sustain pressure, or—per the description—persist the query into a shared resource so that it is re-executed by the platform or other users.

Step 4 — Post-exploitation impact. The uncontrolled allocation exhausts available memory and triggers an out-of-memory condition that terminates the Elasticsearch node. Repeated triggering—or re-execution of the query embedded in a shared resource—produces persistent cluster unavailability, denying search, indexing, and dependent application functionality. The attacker gains no data confidentiality or integrity impact; the objective is denial of service.

Impact Assessment

CVSS:3.1 base score 6.5 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The subscores define the risk profile precisely:

• AV:N (Network) — the vulnerability can be reached across network boundaries; no local access is needed.
• AC:L (Low) — no special conditions or race windows are required.
• PR:L (Low) — a low-privilege authenticated account is sufficient; the bar is holding any valid credential, not administrative access.
• UI:N (None) — no victim interaction is required.
• S:U (Unchanged) — impact is confined to the vulnerable component's security authority.
• C:N / I:N — no confidentiality or integrity loss; this is a pure availability threat.
• A:H (High) — total loss of availability of the affected component is possible.

Business impact. Elasticsearch commonly underpins SIEM/logging pipelines, search, observability, and application data stores. Node termination can blind security monitoring (a compounding risk if the attacker's objective is to suppress detection), disrupt customer-facing search, and interrupt log ingestion. Repeated triggering converts a transient node restart into sustained cluster unavailability, amplifying downtime cost and potentially triggering SLA breaches, regulatory reporting obligations (availability of security telemetry), and incident-response overhead.

Blast radius. Scoped initially to the target node; however, a cluster's shard allocation and recovery behavior means a single OOM-killed node can degrade or destabilize adjacent nodes. Multi-tenant or shared clusters are especially exposed because the PR:L precondition is trivially met by any provisioned tenant account. There is no evidence of exploitation in the wild (CISA KEV: NO), no public exploit code, and no EPSS score (not yet scored by FIRST.org).

Detection Guidance

Sigma Rule

title: Potential Elasticsearch Uncontrolled Resource Consumption Query (CVE-2026-102404)
id: 8f1c2a44-3b7e-4d2a-9c1e-7a5b6d0e2f13
status: experimental
description: Detects repeated expensive query activity from low-privileged accounts preceding Elasticsearch node OOM termination, consistent with CWE-400 abuse (CVE-2026-102404).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102404
author: valtersit.com
date: 2026/01/01
logsource:
  product: elasticsearch
  service: audit
detection:
  selection_action:
    event.action:
      - 'search'
      - '_search'
      - 'search_template'
  selection_status:
    http.response.status_code: 503
  selection_account:
    user.roles|contains:
      - 'viewer'
      - 'read'
      - 'monitoring'
  condition: selection_action and selection_account
  timeframe: 5m
fields:
  - user.name
  - source.ip
  - http.response.status_code
  - event.action
level: medium
tags:
  - attack.t1499
  - cwe.400
falsepositives:
  - Legitimate heavy analytics workloads from read-only accounts
  - Dashboards issuing large but bounded aggregations

YARA Rule

rule CVE_2026_102404_Elasticsearch_Resource_Exhaustion
{
    meta:
        description = "Detects references to uncontrolled resource consumption / excessive allocation abuse in Elasticsearch query content (CVE-2026-102404)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102404"
        cwe = "CWE-400"

    strings:
        $es_api1 = "_search" ascii nocase
        $es_api2 = "search_template" ascii nocase
        $es_api3 = "size" ascii nocase
        $es_api4 = "from" ascii nocase
        $cap = "CAPEC-130" ascii nocase
        $cwe = "CWE-400" ascii nocase

    condition:
        uint16(0) == 0x7B7B or
        ( any of ($es_api*) and any of ($cap, $cwe) ) or
        ( 2 of ($es_api*) )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102404 Possible Elasticsearch Resource Exhaustion Query Attempt"; flow:established,to_server; http.method; content:"GET"; http.method; content:"POST"; http.uri; content:"_search"; http.uri; content:"search_template"; threshold:type both, track by_src, count 30, seconds 60; classtype:attempted-dos; reference:cve,2026-102404; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102404; sid:2026102404; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=60s
  [any where event.action in ("search", "search_template") and user.roles : "viewer"]
  [any where http.response.status_code == 503]

Splunk SPL Query

index=elasticsearch sourcetype=elasticsearch:audit OR sourcetype=elasticsearch:server
(event.action="search" OR event.action="search_template" OR uri="*/_search*")
| bin _time span=1m
| stats count AS query_volume, values(http.response.status_code) AS status_codes, values(user.name) AS users BY source.ip, user.name, _time
| where query_volume > 100
| append [
    search index=elasticsearch "OutOfMemoryError"
    | stats count AS oom_events BY host
]
| table _time, source.ip, user.name, query_volume, status_codes, oom_events, host

Wazuh OSSEC Rule

<group name="elasticsearch,cve-2026-102404,">
  <rule id="1024041" level="8">
    <decoded_as>json</decoded_as>
    <field name="event.action">search|search_template</field>
    <field name="http.response.status_code">503</field>
    <description>CVE-2026-102404: Elasticsearch search returning 503 after sustained query load (possible resource exhaustion).</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>

  <rule id="1024042" level="10" frequency="5" timeframe="120">
    <if_matched_sid>1024041</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-102404: Repeated Elasticsearch resource-exhaustion query pattern from same source (possible denial of service).</description>
  </rule>

  <rule id="1024043" level="12">
    <decoded_as>syslog</decoded_as>
    <match>OutOfMemoryError</match>
    <description>CVE-2026-102404: Elasticsearch java.lang.OutOfMemoryError detected - possible node termination due to uncontrolled allocation.</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected version range is available in the supplied data.

1. Immediate mitigations

• Enforce least privilege: audit and reduce the number of accounts holding any query-capable role; remove read/viewer credentials from external or untrusted parties wherever possible, since PR:L is the only barrier.
• Network-segment the Elasticsearch HTTP API (default TCP/9200) behind authenticated reverse proxies or an API gateway; do not expose it to broad networks.
• Apply query-time resource controls available in the platform (e.g., search-level timeouts, circuit breakers, and request size limits) as defense-in-depth, validating they actually bound memory allocation for the workload in question.
• Constrain JVM heap sizing and set the OS-level OOM handling deliberately so a single node failure does not cascade; ensure cluster topology tolerates the loss of the most exposed nodes.
• Restrict the ability to persist and share query artifacts (saved searches, templates, shared resources) to trusted roles, since the description identifies embedded queries in shared resources as a repeatable trigger.
• Increase monitoring for OOM events and node restarts to shorten detection-to-containment time.

2. Patch / upgrade steps

• No patch is available from tracked sources as of this report. Monitor the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-102404) and the Elastic security advisories channel for a fixed release and its affected-version matrix. Because no affected version range is published, treat all in-use deployments as potentially affected until the vendor clarifies. When a fix ships, stage, test against representative queries, and roll out in a controlled fashion with node-by-node restarts.

3. Long-term hardening

• Adopt a default-deny query-role model with per-tenant resource quotas and rate limits.
• Build capacity controls into the query layer (memory guards, allocation ceilings, execution timeouts) and regression-test them with adversarial "expensive query" suites.
• Integrate Elasticsearch audit and OOM logs into the SIEM with the detection logic above and rehearse the DoS incident playbook.
• Maintain an asset inventory of Elasticsearch nodes, their exposures, and their credential holders to reduce the low-privilege attack surface identified in this CVE.

References

• NVD — CVE-2026-102404: https://nvd.nist.gov/vuln/detail/CVE-2026-102404
• MITRE CWE-400, Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• MITRE CAPEC-130, Excessive Allocation: https://capec.mitre.org/data/definitions/130.html
• MITRE ATT&CK T1499, Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• Elastic Security Advisories (monitor for vendor advisory and fixed version): https://www.elastic.co/community/security

Note: CISA KEV status is NO; no exploit code, public PoC, or Nuclei template is available, and no EPSS score has been assigned (not yet scored by FIRST.org). No known threat actor campaign or exploit-in-the-wild evidence is associated with this CVE in the supplied data.