Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an excessively large description field are created and subsequently accessed, exhausting available heap memory and crashing the affected node.
Affected Versions:
- 8.x: All versions from 8.12.0 up to and including 8.19.22
- 9.x:
- All versions from 9.0.0 up to and including 9.3.8
- All versions from 9.4.0 up to and including 9.4.7
- All versions from 9.5.0 up to and including 9.5.4
No fix is available for the 9.3.x line. Users on this line should upgrade to one of the fixed versions listed in Solutions and Mitigations, or a later release containing the fix. Elasticsearch versions prior to 8.12.0 are not affected, as the Connector API did not exist in those releases.
Affected Configurations:
- Configurations that expose the Connector API to users holding connector management privileges are affected. This includes both self-managed Elasticsearch clusters and Elastic Cloud Hosted deployments where the connector feature is used.
Solutions and Mitigations:
The issue is resolved in versions 8.19.23, 9.4.8, and 9.5.5.
The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading.
For Users that Cannot Upgrade:
- There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE ID: CVE-2026-103005
Problem Type: CWE-789 - Memory Allocation with Excessive Size Value
Impact: CAPEC-130 - Excessive Allocation