A flaw in Elasticsearch lets an authenticated user with the privileges to call the simulate pipeline API submit a request that creates a self‑referential data structure. When a later internal component processes that structure, the operation recurses without bound and triggers a fatal, unhandled error that terminates the node process. The result is a denial of service on the affected node.

The vulnerability affects installations of Elastic Elasticsearch; specific affected versions are not disclosed, so any Elasticsearch deployment that exposes the simulate pipeline API to authenticated users is potentially impacted.

The CVSS score of 6.5 denotes a medium severity issue, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The attack requires an authenticated privileged user to call the simulate pipeline endpoint, which is typically an internal user rather than an externally exposed one. Because the fault is unhandled, a single successful exploitation can crash the node and disrupt service availability, though the vector is not remote; it depends on internal credentials.