Uncontrolled recursion in the Elasticsearch wildcard matching helper can cause a stack overflow when an excessively complex wildcard pattern is evaluated against a long name. This leads to the node shutting down, resulting in an abrupt denial of service rather than a graceful failure. The flaw is a classic example of unchecked recursion with a potential to exhaust resources.

Elastic Elasticsearch products may be impacted; the advisory references versions 8.19.20 and 9.4.5, but specific version ranges are not enumerated in the CVE data. Users running those or earlier releases should verify whether their deployment contains the vulnerable matcher.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through a crafted search request sent to the Elasticsearch REST API; the attacker need only transmit a wildcard query that triggers deep recursion. If successful, the targeted node will crash, disrupting service. The vulnerability is exploitable in distributed environments where a single node shutdown can impact availability of the entire cluster.