Elasticsearch EUVD-2026-93938

Requires an authenticated account with read access to at least one index, and the ability to submit a request defining a scripted runtime field that produces geometry values. The specific vulnerable path is geometry constructed from a script's output, which - unlike text-supplied geometry - is NOT subject to Elasticsearch's nesting-depth limit; text-based geometry is already bounded and not exploitable. Limiting factors: exploitation is impossible for unauthenticated attackers (PR:L), depends on scripting/runtime-fields functionality being usable by the attacker's role, and yields only availability impact (node crash) with no data exposure. Clusters where index-read users are fully trusted or where scripted runtime fields are restricted face substantially lower practical risk.

This is a moderate-priority availability issue, not a drop-everything emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is internally consistent with the description: network-reachable, low attack complexity, requiring low privileges (an authenticated user with read access to one index), no user interaction, and a pure availability impact (node termination) with no confidentiality or integrity loss. The authentication requirement (PR:L) is the single most important mitigating signal - this cannot be triggered by an unauthenticated internet attacker, which meaningfully narrows the threat to users who already hold at least read credentials (insiders, compromised low-privilege accounts, or multi-tenant/self-service query environments). No EPSS score, CISA KEV listing, or SSVC decision data was supplied, and no public exploit is referenced, so exploitation-probability signals are absent rather than conflicting. The aggravating factor is the description's note that affected nodes 'do not recover automatically on all deployments and may require manual intervention,' which raises the real-world operational cost of a single successful request above a transient crash. Net: real but bounded risk - prioritize patching for multi-tenant or externally-queryable Elasticsearch clusters, lower urgency for clusters where all index-read users are fully trusted.

An authenticated user holding read access to any single index submits a search request that defines a scripted runtime field whose script emits a deeply nested geometry structure. Because script-produced geometry bypasses the nesting-depth limit applied to text geometry, serialization recurses until it exhausts the node's stack space, crashing the targeted node. No public proof-of-concept is referenced, but the attack is low-complexity and requires only a single crafted request over the normal query API.