The vulnerability is an uncontrolled recursion flaw that allows an attacker to cause a denial of service by submitting a single, deeply nested search request. This exploits the lack of a recursion depth guard when processing serialized data with nested payloads, leading to an exhaustion of the thread stack and termination of the target node. The weakness falls under CWE‑674, indicating a failure to limit recursion depth, and additionally involves input validation issues classified as CWE‑606, which can be exploited to bypass basic input checks and construct malicious payloads. The result renders the affected Elasticsearch instance unavailable to legitimate users.

The flaw affects Elastic’s Elasticsearch product. Registered users with only read privileges on any single index can trigger the issue, and no specific version information is provided in the vendor statement.

The CVSS score of 6.5 classifies this as a medium severity vulnerability. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, and it is not listed in the CISA KEV catalog. The attack vector is likely internal or on networks where authenticated read access is granted, but it requires only that a legitimate user be able to submit queries to the target node, implying that denial of service could be achieved in many typical deployments.