The vulnerability is an uncontrolled recursion flaw that allows an attacker to cause a denial of service by submitting a single, deeply nested search request. This exploits the lack of a recursion depth guard when processing serialized data with nested payloads, leading to an exhaustion of the thread stack and termination of the target node. The weakness falls under CWE‑674, indicating a failure to limit recursion depth, and would render the affected Elasticsearch instance unavailable to legitimate users.

The flaw affects Elastic’s Elasticsearch product. Registered users with only read privileges on any single index can trigger the issue, and no specific version information is provided in the vendor statement.

The CVSS score of 6.5 classifies this as a medium severity vulnerability. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, and it is not listed in the CISA KEV catalog. The attack vector is likely internal or on networks where authenticated read access is granted, but it requires only that a legitimate user be able to submit queries to the target node, implying that denial of service could be achieved in many typical deployments.