CVE-2026-102408

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: Elastic

Description

Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers catastrophic backtracking, consuming excessive CPU on Elasticsearch worker threads and degrading query throughput for other tenants on the affected node. The cluster does not crash as a result of this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102408

EUVD

EUVD-2026-93929

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	From 9.5.0 (inc) to 9.5.5 (exc)
elastic	elasticsearch	From 8.19.0 (inc) to 8.19.22 (exc)
elastic	elasticsearch	From 9.1.0 (inc) to 9.4.8 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Attack-Flow Graph

Executive Summary

This vulnerability involves inefficient regular expression complexity in Elasticsearch, specifically in the ES|QL CHUNK function. It allows authenticated users with read access to exploit a flaw where user-supplied regular expressions can cause catastrophic backtracking, consuming excessive CPU resources without crashing the cluster.

Detection Guidance

This vulnerability cannot be directly detected using standard commands as it requires analyzing Elasticsearch query patterns and CPU usage during regex processing. Monitor for high CPU usage on Elasticsearch nodes during queries involving the CHUNK function with user-supplied regex patterns.

Impact Analysis

The vulnerability can degrade query performance for all tenants on an affected Elasticsearch node due to excessive CPU consumption by malicious regular expressions. This may lead to slower response times or reduced availability of search services.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA by degrading system performance and availability due to excessive CPU consumption during regex processing. This could lead to unauthorized access delays or service disruptions affecting data integrity and availability requirements.

Mitigation Strategies

Update Elasticsearch to a patched version that validates regular expression complexity in the ES|QL CHUNK function. Restrict authenticated user access to only necessary indices and functions.

Hi! I’m here to help you understand CVE-2026-102408. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70