EUVD-2026-58283
GHSA-2qv5-xh6q-23wv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable REST API, low complexity; read-level authentication required (PR:L); impact is exclusively node availability - no confidentiality or integrity consequence.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without a depth limit, exhausting the thread stack and terminating the affected node.
AnalysisAI
Uncontrolled recursion in Elasticsearch's search request processing allows an authenticated user with only read-level privileges on a single index to crash any cluster node by submitting a specially crafted query containing pathologically nested structures. The absence of a recursion depth limit causes thread stack exhaustion during deserialization of the nested payload, triggering an unhandled stack overflow that terminates the affected node. No public exploit code has been identified at time of analysis, and CISA KEV does not list this CVE, but the low privilege bar (read-only access) makes the attack surface broad in multi-tenant or exposed deployments.
Technical ContextAI
Elasticsearch (CPE: cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*) processes distributed search queries using an internal serialization pipeline. CWE-674 (Uncontrolled Recursion) identifies the root cause: the code path responsible for evaluating deeply nested query structures lacks a configurable or hard-coded recursion depth guard. CAPEC-230 (Serialized Data with Nested Payloads) describes the attack pattern where an adversary deliberately constructs recursive or deeply hierarchical data structures to exhaust stack space. In a JVM-based application like Elasticsearch, thread stack exhaustion typically manifests as a StackOverflowError on the thread servicing the request, which - if unhandled at the node level - can propagate to node termination rather than a graceful HTTP 429 or 400 response.
RemediationAI
Upgrade Elasticsearch to one of the patched releases identified in ESA-2026-118: 8.19.20, 9.4.5, or 9.5.1 (confirm exact fix versions at https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-118/389497). If an immediate upgrade is not feasible, consider the following compensating controls as interim measures: restrict Elasticsearch API access to trusted internal networks or VPNs to prevent external principals from submitting search requests, which eliminates the network vector at a cost of reduced accessibility; audit and minimize the set of accounts holding read privileges, revoking access for any principals that do not strictly require it; implement an API gateway or reverse proxy with a JSON depth-limit or request-size filter ahead of Elasticsearch to reject abnormally nested payloads before they reach the node - the trade-off is added latency and a potential false-positive rate on legitimate deeply nested aggregations. None of these workarounds address the root cause; patching is the definitive fix.
More in Elasticsearch
View allThe Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit
Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deploymen
Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by an
The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secre
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today