Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-56148

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
elastic

Description

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excessive resource consumption while the request is processed, which may render the affected node unavailable.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Elastic Elasticsearch

Default version status: unaffected

  • 9.4.0 to ≤ 9.4.2affected
  • 9.0.0 to ≤ 9.3.5affected
  • 8.0.0 to ≤ 8.19.16affected

References