EUVD-2026-58284
GHSA-rx34-f5m9-h9p5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-accessible REST API, trivial trigger requiring only index creation privilege, pure availability loss confined to the targeted node with no confidentiality or integrity impact.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
2DescriptionCVE.org
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth check, exhausting the thread stack and terminating the affected node.
AnalysisAI
Uncontrolled recursion in Elasticsearch's custom analysis definition processing allows an authenticated low-privileged user to crash an individual cluster node with a single request. By submitting a malformed index creation request whose custom analyzer, tokenizer, or filter components reference each other without termination, the resolution logic enters unbounded recursion, exhausts the JVM thread stack, and terminates the targeted node. No public exploit has been identified at time of analysis, but the attack requires only index creation privileges - a permission commonly granted to application service accounts - making the practical barrier lower than the authentication prerequisite might suggest.
Technical ContextAI
Elasticsearch exposes an index settings API that accepts custom analysis chain definitions (analyzers, tokenizers, character filters, token filters) as part of index creation. Internally, these definitions are resolved by traversing component references recursively. CWE-674 (Uncontrolled Recursion) identifies the root cause: no depth limit or cycle detection guards this traversal, so a specially crafted definition graph causes the JVM call stack to grow unbounded until a StackOverflowError terminates the thread and crashes the node process. The affected product is identified by CPE cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:* - the wildcard version field indicates the flaw spans the entire product line prior to the patched releases. The attack is classified under CAPEC-153 (Input Data Manipulation), reflecting that the exploit payload is delivered as structured data rather than a code injection.
RemediationAI
The Elastic vendor advisory ESA-2026-119 at https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-119/389498 confirms patched releases at Elasticsearch 8.19.20 and 9.4.5; operators should upgrade to one of these versions as the primary remediation. For deployments that cannot patch immediately, restrict index creation privileges (indices:admin/create) to the minimal set of trusted service accounts using Elasticsearch's role-based access control - note that removing this privilege from CI/CD or ETL accounts may break dynamic index provisioning workflows and should be tested before applying in production. Additionally, placing a network-layer control (firewall rule, API gateway, or Elasticsearch security perimeter) to limit which internal hosts can reach the Elasticsearch REST API reduces exposure to lateral-movement scenarios where a compromised low-privilege account reaches the cluster. No other workaround that neutralizes the recursive resolution flaw without upgrading has been identified from available data.
More in Elasticsearch
View allThe Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the s
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execut
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause
All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit
Remote code execution in Elasticsearch's machine learning component allows an authenticated user with ML model deploymen
Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by an
The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secre
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today