CVE-2026-103008

Awaiting Analysis Awaiting Analysis - Queue

Uncontrolled Recursion in Elasticsearch Leads to DoS

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: Elastic

Description

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds and serializes geometry values produced by scripted runtime fields. Unlike geometry supplied as text, which is subject to a nesting-depth limit, geometry constructed from a script's output is not bounded. An authenticated user with read access to a single index can submit a request defining such a field with a script that produces a deeply nested structure. Processing this request recurses past the available stack space, causing the affected node to terminate. The node does not recover automatically on all deployments and may require manual intervention to restore service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103008

EUVD

EUVD-2026-93938

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	From 9.5.0 (inc) to 9.5.5 (exc)
elastic	elasticsearch	From 9.0.0 (inc) to 9.4.8 (exc)
elastic	elasticsearch	From 8.12.0 (inc) to 8.19.23 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability is an uncontrolled recursion issue in Elasticsearch that can cause a Denial of Service. It occurs when a specially crafted request creates a deeply nested data structure without a recursion depth limit. The server processes this structure, leading to excessive stack usage and crashing the affected node.

Detection Guidance

Detecting this vulnerability requires monitoring for abnormal recursion depth in Elasticsearch requests. Check Elasticsearch logs for stack overflow errors or crashes. Use tools like curl to inspect requests containing scripted runtime fields for deeply nested structures. Example: curl -XGET 'http://localhost:9200/_nodes/stats' to check node health.

Impact Analysis

An authenticated user with read access to a single index can exploit this to crash Elasticsearch nodes. This disrupts service availability, requiring manual intervention to restore operations. The impact includes downtime and potential data access issues.

Compliance Impact

This vulnerability may lead to service disruptions, which could violate availability requirements in GDPR and HIPAA. Downtime could result in unauthorized access risks or failure to meet data protection timelines.

Mitigation Strategies

Upgrade Elasticsearch to the latest patched version. Disable scripted runtime fields if not required. Apply input validation to limit recursion depth in requests. Restrict read access to indices for untrusted users. Monitor for unusual requests or crashes.

Hi! I’m here to help you understand CVE-2026-103008. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70