Uncontrolled Recursion (CWE-674) in Elasticsearch’s query evaluation component allows a low‑privileged authenticated user to submit a specially crafted search request that triggers unbounded recursion, causing a fatal error that terminates the affected node. In a single‑node deployment this results in a complete service outage, while in multi‑node clusters it causes repeated node restarts and sustained availability degradation.

Elastic:Elasticsearch products are affected. No specific version information is provided, so all deployments of Elasticsearch that have not applied the latest security patch are potentially vulnerable.

The CVSS score of 6.5 classifies the vulnerability as moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation at present. The likely attacker is an authenticated user with read‑level index access who submits the malicious search request through the Elasticsearch REST API. Once triggered, the recursive processing exhausts resources and results in node failure.