CVE-2026-63144

Analyzed Analyzed - Analysis Complete

Denial of Service via Uncontrolled Recursion in Elasticsearch

Publication date: 2026-07-21

Last updated on: 2026-08-03

Assigner: Elastic

Description

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that terminates the affected node. In single-node deployments, this results in complete service outage; in multi-node clusters, it causes repeated node restarts and sustained availability degradation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-03

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-63144

EUVD

EUVD-2026-47583

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	From 9.4.0 (inc) to 9.4.4 (exc)
elastic	elasticsearch	From 8.19.0 (inc) to 8.19.19 (exc)
elastic	elasticsearch	From 9.3.0 (inc) to 9.3.8 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability is an uncontrolled recursion issue in Elasticsearch that allows a low-privileged authenticated user to cause a denial of service. The flaw occurs when a specially crafted search request triggers unbounded recursive processing in the query evaluation component, leading to a fatal error that terminates the affected node.

Detection Guidance

To detect this vulnerability, monitor Elasticsearch logs for fatal errors or repeated node restarts caused by search requests. Check for unbounded recursive processing in query evaluation logs. Use Elasticsearch APIs like _nodes/stats or _cluster/health to identify abnormal node behavior or service outages.

Impact Analysis

In single-node deployments, this can cause a complete service outage. In multi-node clusters, it leads to repeated node restarts and sustained availability degradation, disrupting normal operations.

Compliance Impact

This vulnerability can impact compliance with GDPR and HIPAA by causing service outages or degraded availability in Elasticsearch deployments. GDPR requires data availability and integrity, while HIPAA mandates reliable access to protected health information. Denial of service or repeated node restarts may violate these requirements.

Mitigation Strategies

Apply the latest Elasticsearch security patches immediately. Restrict user permissions to the minimum required for their roles. Monitor cluster health for repeated node restarts or fatal errors.

Hi! I’m here to help you understand CVE-2026-63144. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70