What is the CVSS score of CVE-2026-56148?

CVE-2026-56148 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Elasticsearch CVE-2026-56148

EUVD-2026-41065 MEDIUM

Uncontrolled Recursion (CWE-674)

2026-07-01 security@elastic.co

GHSA-j6j2-p5xw-w2j8

Elastic Denial Of Service Elasticsearch

6.5

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable query API, low privilege required, availability-only impact; no confidentiality or integrity loss applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 01, 2026 - 17:42 vuln.today

DescriptionCVE.org

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excessive resource consumption while the request is processed, which may render the affected node unavailable.

AnalysisAI

Denial of service in Elasticsearch allows any authenticated user to crash an affected cluster node by submitting a specially crafted query that triggers uncontrolled recursion during query processing. Excessive resource consumption during request handling can render the targeted node unavailable, disrupting search and indexing operations for all dependent applications. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the low privilege requirement makes it accessible to any user with query access.

Technical ContextAI

Elasticsearch is a widely-deployed distributed search and analytics engine built on Apache Lucene. This vulnerability (CWE-674: Uncontrolled Recursion) occurs within the query processing pipeline: a crafted query structure causes the parser or execution engine to recurse without adequate depth bounds, leading to excessive heap or stack allocation (CAPEC-130: Excessive Allocation). The CVSS vector AV:N/AC:L/PR:L confirms the flaw is reachable over the network by any authenticated user with query privileges, requiring no special configuration. The scope is unchanged (S:U), meaning the impact is confined to the affected node rather than propagating to the broader cluster at the OS or hypervisor level, though in practice a downed node degrades cluster availability.

RemediationAI

Upgrade Elasticsearch to version 8.19.17 (for 8.x deployments), 9.3.6, or 9.4.3 (for 9.x deployments) as documented in Elastic Security Advisory ESA-2026-42 at https://discuss.elastic.co/t/elasticsearch-8-19-17-9-3-6-9-4-3-security-update-esa-2026-42. If immediate patching is not possible, restrict query API access to trusted, known-good service accounts and remove query privileges from non-essential users - this reduces the attacker pool but does not eliminate risk from compromised or malicious authorized accounts. Network-layer controls such as placing Elasticsearch behind an API gateway or firewall that limits query endpoint access to specific source IPs can further constrain exposure. Query complexity limits or circuit breakers, if configurable in the deployed version, should be reviewed and tightened as a compensating control; note that overly aggressive circuit breaker settings may also impact legitimate heavy queries.