EUVD-2026-58247
GHSA-5m3v-69rx-39vv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-accessible API requiring low-privilege authentication; impact is strictly availability via node process termination, with no confidentiality, integrity, or scope-change effects.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate) to submit a request that causes a self-referential data structure to be created. When a specific internal component later processes that structure, the operation recurses without bound and raises a fatal error that is not handled by the surrounding execution path, terminating the affected node process and resulting in a denial of service.
AnalysisAI
Node process termination in Elasticsearch via the ingest simulate pipeline API allows low-privilege authenticated users to crash individual cluster nodes by submitting a crafted request that induces uncontrolled recursion. The vulnerability affects multiple Elasticsearch version lines, with Elastic releasing fixes in versions 8.19.1, 9.3.8, and 9.4.4 per advisory ESA-2026-75. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis, but the low attack complexity and broad enterprise footprint of Elasticsearch make this a meaningful availability risk, particularly in multi-tenant or shared-cluster deployments.
Technical ContextAI
Elasticsearch is a distributed search and analytics engine (CPE: cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*) widely used for log aggregation, full-text search, and observability pipelines. The simulate pipeline API endpoint allows users to test ingest pipeline configurations without persisting data - a standard operational and development feature. The vulnerability is classified as CWE-674 (Uncontrolled Recursion): a crafted pipeline definition can cause a self-referential data structure to be created, which an internal traversal component then processes recursively without depth limit or cycle detection. The resulting stack exhaustion raises a fatal error that is not caught by the surrounding execution context, terminating the JVM node process entirely rather than returning a graceful error to the caller. This pattern - where input validation fails to detect cyclic references prior to traversal - is a well-understood class of DoS in tree/graph-processing engines.
RemediationAI
Upgrade Elasticsearch to version 8.19.1, 9.3.8, or 9.4.4 as appropriate for your installed branch, per Elastic's security advisory ESA-2026-75 at https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-75/389496. If immediate patching is not feasible, restrict access to the simulate pipeline API by auditing and tightening Elasticsearch RBAC roles: remove the manage_pipeline privilege and any explicit indices:admin/ingest/pipeline/simulate permission from roles that do not have an explicit operational need for pipeline testing. This compensating control will disrupt pipeline development and CI/CD testing workflows that rely on the simulate endpoint, so coordinate with data engineering and DevOps teams before applying. Network-layer ACLs are not a reliable workaround because the simulate endpoint shares the same HTTP port and transport as all other Elasticsearch APIs; blocking it at the network layer would block all cluster API traffic.
More in Elasticsearch
View allThe Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit
Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deploymen
Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by an
The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secre
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today