EUVD-2026-58250
GHSA-qj5v-cq2v-qvgj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable API with low privileges sufficient to trigger the fault; single request terminates the node, yielding high availability impact with no confidentiality or integrity exposure.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation causes the thread to exhaust its stack. The resulting fatal error is not handled by the surrounding execution paths and terminates the affected node process, producing a denial of service.
AnalysisAI
Stack exhaustion in Elasticsearch allows any low-privileged authenticated user to crash an Elasticsearch node with a single crafted request. Affected are all Elasticsearch versions across the 8.x and 9.x release lines, with Elastic releasing fixed versions 8.19.20, 9.4.5, and 9.5.1 under ESA-2026-78. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and minimal privilege requirement make this a straightforward denial-of-service vector for any credentialed user.
Technical ContextAI
Elasticsearch is a distributed search and analytics engine (CPE: cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*) that exposes an HTTP/JSON API for queries, indexing, and cluster management. CWE-674 (Uncontrolled Recursion) identifies the root cause: a specific internal validation component processes user-supplied input values using a recursive routine that enforces no maximum recursion depth or stack-depth guard. When a crafted input of sufficient nesting or structural complexity is submitted, the recursive validation exhausts the JVM thread's call stack. The resulting fatal stack overflow error is not caught by the surrounding exception handlers, causing the Elasticsearch node's JVM process to terminate abruptly rather than recovering gracefully. This pattern - missing base-case depth limits in recursive validators applied to untrusted input - is a known anti-pattern in services that parse arbitrarily structured data.
RemediationAI
Upgrade Elasticsearch to version 8.19.20, 9.4.5, or 9.5.1, whichever applies to the deployed branch, as released under Elastic Security Advisory ESA-2026-78 (https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-78/389505). If immediate upgrade is not operationally feasible, restrict Elasticsearch API access so that only highly trusted or highly privileged accounts can submit document or query payloads, reducing the population of users who can trigger the vulnerable validation path; note this may break workflows relying on low-privileged service accounts. Placing Elasticsearch behind an authenticated reverse proxy or API gateway that enforces strict input-size limits or payload depth constraints may also reduce exposure, but neither workaround eliminates the underlying code path and both carry trade-offs in operational complexity and latency.
More in Elasticsearch
View allThe Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit
Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deploymen
Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by an
The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secre
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today