EUVD-2026-47583
GHSA-5v5g-hvw6-x2x7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
PR:L reflects mandatory read-level authentication; A:H captures node crash; C and I are N as there is no data access or modification impact.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that terminates the affected node. In single-node deployments, this results in complete service outage; in multi-node clusters, it causes repeated node restarts and sustained availability degradation.
AnalysisAI
Uncontrolled recursion in Elasticsearch's query evaluation component allows a low-privileged authenticated user with read-level index access to crash an affected node by submitting a specially crafted search request. All three active release lines are affected: 8.19.x through 8.19.18, 9.3.x through 9.3.7, and 9.4.x through 9.4.3. The impact ranges from complete service outage in single-node deployments to sustained availability degradation and repeated node restarts in multi-node clusters. No public exploit code or active exploitation has been identified at time of analysis; Elastic has released patched versions 8.19.19, 9.3.8, and 9.4.4.
Technical ContextAI
Elasticsearch is a distributed search and analytics engine built on Apache Lucene. CWE-674 (Uncontrolled Recursion) describes a failure to impose depth or iteration limits on recursive logic, allowing input to drive call-stack growth until a fatal stack overflow or equivalent runtime error terminates the process. In this case, the vulnerable component is the query evaluation path: Elasticsearch's search layer processes user-submitted query DSL structures, and a specially crafted query can trigger recursive evaluation logic that lacks a depth bound. Because Elasticsearch nodes operate as JVM processes, unbounded recursion produces a fatal error that kills the JVM, requiring a node restart. The CVSS vector AV:N/AC:L/PR:L confirms the vulnerability is remotely exploitable at low complexity, requiring only read-level (index-level) authentication - no elevated privileges or specific index configuration beyond basic access is needed.
RemediationAI
Upgrade to Elasticsearch 8.19.19 (for 8.19.x deployments), 9.3.8 (for 9.3.x deployments), or 9.4.4 (for 9.4.x deployments) per the Elastic security advisory ESA-2026-68 at https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-68/388571. If immediate patching is not possible, restrict search API access at the network layer to trusted internal hosts or authenticated services only, reducing exposure from broadly distributed read credentials. Additionally, audit and tighten index-level privilege grants - revoke read access for accounts that do not require it, minimizing the population of users capable of triggering this path. Note that restricting API access may impact legitimate search clients and monitoring integrations; coordinate with application owners before applying network-layer controls.
More in Elasticsearch
View allThe Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit
Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deploymen
Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by an
The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secre
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today