CVE-2026-56148

Analyzed Analyzed - Analysis Complete

Uncontrolled Recursion in Elasticsearch Leads to DoS

Publication date: 2026-07-01

Last updated on: 2026-07-02

Assigner: Elastic

Description

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excessive resource consumption while the request is processed, which may render the affected node unavailable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-01

Last Modified

2026-07-02

Generated

2026-07-22

AI Q&A

2026-07-01

EPSS Evaluated

2026-07-20

NVD

CVE-2026-56148

EUVD

EUVD-2026-41065

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	From 8.0.0 (inc) to 8.19.17 (exc)
elastic	elasticsearch	From 9.0.0 (inc) to 9.3.6 (exc)
elastic	elasticsearch	From 9.4.0 (inc) to 9.4.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

CVE-2026-56148 is a vulnerability in Elasticsearch versions 8.x and 9.x where an authenticated user can submit a specially crafted query that triggers uncontrolled recursion. This causes excessive resource consumption during query processing, which can lead to a denial of service by making the affected node unavailable.

Detection Guidance

This vulnerability involves an authenticated user submitting a specially crafted query that causes excessive resource consumption, potentially leading to denial of service. Detection would involve monitoring for unusual resource usage or denial of service symptoms on Elasticsearch nodes.

There are no specific commands or detection tools mentioned in the provided resources or context to identify this vulnerability directly.

Impact Analysis

The vulnerability can impact you by allowing an authenticated user with query submission privileges to cause a denial of service on an Elasticsearch node. This happens because the specially crafted query consumes excessive resources, potentially rendering the node unavailable and disrupting service availability.

Compliance Impact

The provided information does not specify any direct impact of CVE-2026-56148 on compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

The primary mitigation step is to upgrade Elasticsearch to a fixed version where the vulnerability is resolved.

Upgrade to Elasticsearch version 8.19.17 or later if using 8.x versions.
Upgrade to Elasticsearch version 9.3.6 or later if using 9.x versions.
Upgrade to Elasticsearch version 9.4.3 or later if using 9.4.x versions.

No workarounds are available for users unable to upgrade, so upgrading is the only effective immediate mitigation.

Hi! I’m here to help you understand CVE-2026-56148. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70