Description
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated user with read access to a single index can submit a specially crafted request containing deeply nested aggregation definitions. Processing this request triggers unbounded recursive execution that exhausts the server process's available resources, causing the affected node to terminate. The node does not recover automatically and requires manual intervention to restore service.
Published: 2026-10-06
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service resource exhaustion
Action: Assess Impact
AI Analysis

Impact

Elasticsearch contains an uncontrolled recursion flaw that allows an authenticated user with read access to submit a deeply nested aggregation request. Processing this request triggers unbounded recursive calls, exhausting the node's memory and CPU, and causes the node to terminate. The process does not restart automatically, requiring manual intervention to restore service.

Affected Systems

Affected products: Elasticsearch by Elastic. No specific version information is provided.

Risk and Exploitability

The vulnerability receives a CVSS score of 6.5, indicating a moderate severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the flaw is not listed in CISA’s KEV catalog. The attack requires an authenticated user with the ability to use the search aggregation endpoint, typically over the cluster network. Once executed, the attacker can cause a local or remote denial of service without escalating privileges.

Generated by OpenCVE AI on October 8, 2026 at 14:45 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Elasticsearch security update that addresses uncontrolled recursion, following the guidance in the official Elastic discussion post
  • Limit or disable aggregation features for users who do not need them, or enforce a maximum depth restriction on aggregation queries
  • Monitor cluster logs for unusually deep aggregation requests and set alerts to detect potential abuse

Generated by OpenCVE AI on October 8, 2026 at 14:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 06 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Elastic
Elastic elasticsearch
Vendors & Products Elastic
Elastic elasticsearch

Tue, 06 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
Description Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated user with read access to a single index can submit a specially crafted request containing deeply nested aggregation definitions. Processing this request triggers unbounded recursive execution that exhausts the server process's available resources, causing the affected node to terminate. The node does not recover automatically and requires manual intervention to restore service.
Title Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Weaknesses CWE-674
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Elastic Elasticsearch
cve-icon MITRE

Status: PUBLISHED

Assigner: elastic

Published:

Updated: 2026-10-06T19:53:22.509Z

Reserved: 2026-09-29T20:57:38.467Z

Link: CVE-2026-103006

cve-icon Vulnrichment

Updated: 2026-10-06T19:53:18.840Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T20:17:13.730

Modified: 2026-10-09T13:26:04.043

Link: CVE-2026-103006

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-06T19:31:49Z

Links: CVE-2026-103006 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-08T15:00:16Z

Weaknesses
  • CWE-674

    Uncontrolled Recursion

  • CWE-770

    Allocation of Resources Without Limits or Throttling