CVE-2026-115290
Received Received - Intake

Uncontrolled Recursion in Elasticsearch Leads to DoS

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Elastic

Description
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-115290
EUVD
EUVD-2026-116072

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Elastic Elasticsearch 8.10.0
Elastic Elasticsearch 9.0.0
Elastic Elasticsearch 9.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an uncontrolled recursion issue in Elasticsearch that can cause a denial of service. An attacker can exploit it by sending a specially crafted request with nested payloads to a node's server interface. This triggers excessive recursion, leading the node to terminate. No authentication is required, and the attack can be repeated against any reachable node.

Impact Analysis

The impact includes service disruption as affected nodes may crash, leading to downtime for Elasticsearch clusters. Unauthorized users can exploit this remotely without credentials, potentially affecting availability across multiple nodes. Repeated attacks could prolong outages.

Mitigation Strategies

Update Elasticsearch to the latest patched version immediately to address the uncontrolled recursion vulnerability. Restrict network access to the Elasticsearch cluster server interface using firewalls or network segmentation to prevent unauthenticated attackers from sending crafted requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-115290. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...