Uncontrolled recursion in Elasticsearch (CWE‑674) allows an attacker who is authenticated but only has low‑privilege index‑creation rights to submit a specially crafted custom analysis definition that contains deeply nested recursive references. Because the resolver lacks a cycle or depth check, the processing exhausts the thread stack and causes the node to terminate. The result is a denial‑of‑service condition that impacts the availability of the affected cluster.

The vulnerability affects Elastic's Elasticsearch product. Prior to the release of the recent security updates (Elasticsearch 8.19.20 and 9.4.5), all unsupported and supported minor releases are potentially vulnerable. The security advisory recommends upgrading to these fixed versions or later.

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score is not available, while the vulnerability is not listed in CISA's KEV catalog. Because the exploit requires authentication with index‑creation rights, an attacker with that limited privilege could trigger the stack exhaustion, leading to node downtime. The lack of an EPSS score and non‑KEV status means there is currently no evidence of widespread exploitation, but the impact on availability makes this a noteworthy concern for organizations running Elasticsearch.