Elasticsearch CVE-2026-102404

Exploitation requires an authenticated account with at least low privileges that can submit queries to the Elasticsearch query processing engine (CVSS PR:L) - it is not reachable by fully unauthenticated attackers. No user interaction is needed (UI:N) and no non-default feature toggle is named in the description; the crafted query itself is the trigger, with AC:L indicating no special conditions beyond submitting it. The limiting factors are therefore the authentication requirement and the breadth of query access granted in a given deployment: clusters that expose query access only to trusted internal operators face lower realistic risk than multi-tenant or broadly-accessible clusters. Impact is availability-only (node OOM termination and, via queries embedded in shared resources, persistent cluster unavailability); there is no path to data disclosure or modification. Affected versions are 8.0.0-8.19.22, 9.0.0-9.4.7, and 9.5.0-9.5.4.

This is a moderate-severity availability-only denial of service, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) scores 6.5 and tells a coherent story: network-reachable, low attack complexity, no user interaction, but requiring low-privileged authentication, with impact confined entirely to availability (C:N/I:N). No EPSS score, KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization - this is a vendor-reported (security@elastic.co) issue, which typically means coordinated disclosure with a patch rather than in-the-wild abuse. The real-world priority is driven less by the raw CVSS number and more by the description's note that the condition is repeatable and can be embedded in shared resources, causing persistent cluster unavailability - that elevates it from a transient crash to a potential sustained outage for any tenant who can run queries. Net: not a drop-everything emergency (no exploitation evidence, no confidentiality/integrity impact, authentication required), but a genuine operational-risk patch priority for multi-tenant or internet-adjacent Elasticsearch clusters where low-privileged query access is broadly granted.

A user with legitimate but low-privileged query access (e.g., a dashboard analyst or a tenant in a shared cluster) submits a specially crafted query that drives uncontrolled memory growth in the query processing engine, exhausting the node's heap and triggering an out-of-memory kill. Because the query can be stored in a shared resource (e.g., a saved search or dashboard), the OOM recurs each time the resource is loaded, producing persistent cluster unavailability. No public exploit was identified at time of analysis, and the low CVSS attack complexity (AC:L) means no special timing or race conditions are required once the authenticated access exists.