Uncontrolled Memory Allocation in Elasticsearch - CVE-2026-103005
Published: October 7, 2026
Vulnerability identifier: #VU153937
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-103005
CWE-ID: CWE-789
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to memory allocation with an excessive size value in the Elasticsearch Connector API when connector resources with excessively large description fields are created and subsequently accessed. A remote user can create such connector resources and subsequently access them to cause a denial of service.
Exploitation requires connector management privileges and a configuration that exposes the Connector API.
Affected software
Elasticsearch
How to mitigate CVE-2026-103005
Install security update from vendor's website.
Elasticsearch - addressed in versions 8.19.23, 9.4.8, 9.5.5