EUVD-2026-58222
GHSA-mmpx-jcfp-p3wg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable via search API requiring only low-privilege credentials; pure availability impact with node shutdown, no data exposure or integrity effect.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of match operations performed. A search request containing a wildcard pattern with a large number of wildcard groups, evaluated against a sufficiently long name, exhausts the thread stack. Elasticsearch treats a stack overflow as an unrecoverable condition and shuts the node down, so the request terminates the affected node rather than failing gracefully.
AnalysisAI
Denial of service in Elasticsearch's wildcard matching component allows any authenticated user with search access to terminate an affected node by submitting a single crafted query. The recursive wildcard evaluator has no bounds on recursion depth or total match operations; a pattern containing many wildcard groups evaluated against a sufficiently long field name exhausts the JVM thread stack, triggering a StackOverflowError that Elasticsearch treats as unrecoverable, causing immediate node shutdown rather than graceful request failure. No public exploit has been identified at time of analysis, but exploitation requires only low-privilege search access (CVSS PR:L), meaning any application service account or authenticated API user represents a viable threat origin.
Technical ContextAI
Elasticsearch uses a wildcard matching helper to resolve pattern queries against index field names and values. The affected function implements matching recursively without enforcing a maximum recursion depth or bounding the total number of recursive invocations, representing a classic CWE-674 (Uncontrolled Recursion) defect. Each wildcard group in a crafted pattern introduces an additional recursive call frame on the JVM thread stack; given a sufficiently long target string and many wildcard groups, the cumulative stack depth exceeds the thread's allocated stack space. The JVM throws a StackOverflowError which Elasticsearch is designed to treat as an unrecoverable condition, resulting in node termination rather than a bounded error response. This maps to CAPEC-130 (Excessive Allocation) because the attacker forces unbounded consumption of stack memory through a maliciously constructed input. The affected product scope per CPE is cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*, covering all Elasticsearch versions across both the 8.x and 9.x branches prior to the patched releases.
RemediationAI
Upgrade Elasticsearch to version 8.19.20 (8.x branch) or 9.4.5 (9.x branch), as identified in Elastic Security Advisory ESA-2026-133 at https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-133/389499. If an immediate upgrade is not feasible, restrict search permissions to the minimum set of trusted, explicitly authorized users and service accounts, since exploitation requires at least low-privilege search access (PR:L); revoking broad or anonymous search grants reduces the attacker pool without affecting core cluster functionality. If an API gateway or reverse proxy sits in front of Elasticsearch, configuring query size or complexity limits on the wildcard operator field can reduce exposure, though this may reject some legitimate complex queries as a trade-off and should be validated against application workloads. Ensure cluster monitoring and alerting are configured to detect unexpected node shutdowns promptly so that operational impact can be contained quickly if exploitation occurs before patching.
More in Elasticsearch
View allThe Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit
Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deploymen
Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by an
The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secre
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today