Skip to main content

Elasticsearch CVE-2026-56148

| EUVDEUVD-2026-41065 MEDIUM
Uncontrolled Recursion (CWE-674)
2026-07-01 security@elastic.co GHSA-j6j2-p5xw-w2j8
Elastic Denial Of Service Elasticsearch
6.5
CVSS 3.1 · Vendor: elastic
Share

Severity by source

Vendor (elastic) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

Network-reachable query API, low privilege required, availability-only impact; no confidentiality or integrity loss applies.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
Analysis Generated
Jul 01, 2026 - 17:42 vuln.today

DescriptionCVE.org

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excessive resource consumption while the request is processed, which may render the affected node unavailable.

AnalysisAI

Denial of service in Elasticsearch allows any authenticated user to crash an affected cluster node by submitting a specially crafted query that triggers uncontrolled recursion during query processing. Excessive resource consumption during request handling can render the targeted node unavailable, disrupting search and indexing operations for all dependent applications. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain low-privilege Elasticsearch credentials
Delivery
Craft deeply recursive query structure
Exploit
Submit query via REST API
Execution
Trigger uncontrolled recursion in query engine
Persist
Exhaust node memory or stack
Impact
Target node becomes unavailable
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid Elasticsearch account with at minimum query (search) privileges, confirmed by the CVSS PR:L metric. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The NVD-assigned CVSS 6.5 (Medium) reflects the limited impact profile: availability-only with no confidentiality or integrity loss (C:N/I:N/A:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who holds any low-privilege Elasticsearch account - such as a developer with read access or an application service account - crafts a query containing deeply nested or recursively structured clauses and submits it via the standard REST API on port 9200. The query processing engine enters uncontrolled recursion, exhausting available resources until the node becomes unresponsive and drops out of the cluster. …
Remediation Upgrade Elasticsearch to version 8.19.17 (for 8.x deployments), 9.3.6, or 9.4.3 (for 9.x deployments) as documented in Elastic Security Advisory ESA-2026-42 at https://discuss.elastic.co/t/elasticsearch-8-19-17-9-3-6-9-4-3-security-update-esa-2026-42. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Elasticsearch

View all
CVE-2015-5531 MEDIUM POC
5.0 Aug 17

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
CVE-2015-3337 MEDIUM POC
4.3 May 01

Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
CVE-2021-22146 HIGH POC
7.5 Jul 21

All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
CVE-2021-22145 MEDIUM POC
6.5 Jul 21

A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit
CVE-2020-7014 HIGH
8.8 Jun 03

The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
CVE-2020-7009 HIGH
8.8 Mar 31

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
CVE-2018-3831 HIGH
8.8 Sep 19

Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secre
CVE-2019-7611 HIGH
8.1 Mar 25

A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Le
CVE-2015-4165 HIGH
7.5 Aug 09

The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files

CVE-2023-46674 HIGH
7.8 Dec 05

An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration prope
CVE-2019-3800 HIGH
7.8 Aug 05

CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when th
CVE-2024-23444 HIGH
7.5 Jul 31

It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order

Same weakness CWE-674 – Uncontrolled Recursion

View all
CVE-2019-9545 HIGH POC
8.8
CVE-2019-9543 HIGH POC
8.8
CVE-2019-9144 HIGH POC
8.8
CVE-2019-9143 HIGH POC
8.8
CVE-2025-9624 HIGH POC
8.3
CVE-2021-28210 HIGH POC
7.8
CVE-2018-9918 HIGH POC
7.8
CVE-2025-57809 HIGH POC
7.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2026-56148 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy