CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-102411

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to Denial of Service via Excessive Allocation (CAPEC-130). Elasticsearch enforces a size limit on the user-supplied metadata field for each individual template resource, but does not limit the total memory used when multiple such resources are retrieved together. A user holding the *manage_index_templates* cluster privilege can register multiple resources each within the individual limit. Retrieving them together materializes all of their metadata values in memory at once, exhausting available heap and causing the affected node to fail with an out-of-memory error, resulting in a denial of service.

Score
6.5 medium
Published
2026-10-06
Links
NVD · cve.org

Matched ports (1)

PortPackageVersionStatusMaintainer
textproc/py-elasticsearchpy312-elasticsearch9.5.1unaddressedsunpoet@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>py312-elasticsearch</name>
	<range><lt>8.19.23</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Allocation of Resources Without Limits or Throttling (CWE-770) in
	Elasticsearch can lead to Denial of Service via Excessive Allocation
	(CAPEC-130). Elasticsearch enforces a size limit on the user-supplied
	metadata field for each individual template resource, but does not
	limit the total memory used when multiple such resources are retrieved
	together. A user holding the *manage_index_templates* cluster
	privilege can register multiple resources each within the individual
	limit. Retrieving them together materializes all of their metadata
	values in memory at once, exhausting available heap and causing the
	affected node to fail with an out-of-memory error, resulting in a
	denial of service.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-102411</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-102411</url>
    </references>
    <dates>
      <discovery>2026-10-06</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>