CVE-2026-103006

Awaiting Analysis Awaiting Analysis - Queue

Uncontrolled Recursion in Elasticsearch Leads to DoS

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: Elastic

Description

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated user with read access to a single index can submit a specially crafted request containing deeply nested aggregation definitions. Processing this request triggers unbounded recursive execution that exhausts the server process's available resources, causing the affected node to terminate. The node does not recover automatically and requires manual intervention to restore service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103006

EUVD

EUVD-2026-93936

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	From 8.0.0 (inc) to 8.19.21 (exc)
elastic	elasticsearch	From 9.0.0 (inc) to 9.4.6 (exc)
elastic	elasticsearch	From 9.5.0 (inc) to 9.5.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability is an uncontrolled recursion issue (CWE-674) in Elasticsearch that allows a Denial of Service attack. An authenticated user with read access to an index can send a deeply nested request to the search API's aggregation feature. This triggers unbounded recursive processing, consuming server resources until the node crashes and requires manual restart.

Detection Guidance

Detecting this vulnerability requires monitoring for unusually high resource consumption during search aggregation requests. Check Elasticsearch logs for requests with deeply nested aggregations or excessive processing times. Use system monitoring tools like top, htop, or Elasticsearch's own monitoring APIs to observe CPU, memory, and thread usage spikes during aggregation-heavy queries.

Impact Analysis

If exploited, this vulnerability can cause your Elasticsearch server to crash, leading to downtime and loss of access to search functionality. It requires an attacker to have at least read access to an index, but once triggered, it can disrupt service for all users relying on that Elasticsearch node.

Compliance Impact

This vulnerability can lead to Denial of Service (DoS) by exhausting server resources, which may cause service disruptions. For GDPR, such disruptions could impact data availability and processing, potentially violating Article 32 requirements for security and integrity. For HIPAA, it may disrupt access to protected health information, affecting the availability requirement under the Security Rule.

Mitigation Strategies

Immediately upgrade Elasticsearch to the latest patched version. Temporarily restrict access to the aggregation feature by disabling it in the configuration or applying strict query validation rules. Monitor affected nodes closely and prepare for manual intervention if nodes terminate unexpectedly.

Hi! I’m here to help you understand CVE-2026-103006. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70