A flaw in Elasticsearch’s internal component validates a user‑supplied value with an unbounded recursive routine. When a low‑privileged authenticated user submits a crafted request, the recursion consumes the thread’s stack so quickly that a stack overflow occurs. The exception is not caught, causing the node process to terminate and the cluster to experience a denial of service. The weakness corresponds to CWE‑674 and is rated with a CVSS score of 6.5, indicating moderate severity.

The vulnerability affects Elastic’s Elasticsearch product. No specific version ranges are provided in the advisory, so any deployed Elasticsearch instance that has not been patched by Elastic could be susceptible. Administrators should verify the exact patch level against the Elastic security update catalog listed in the advisory.

Attackers must first authenticate with a low‑privileged role that can send requests to the vulnerable endpoint; the HTTP request alone is sufficient to trigger the recursion. Because the flaw leads to an unhandled stack overflow, a successful exploit will terminate the node process. The EPSS metric is not available, and the issue is not present in the CISA KEV catalog, which suggests current public exploitation is low but the impact remains significant. The CVSS score of 6.5 underscores the moderate risk of Denial‑of‑Service, especially in production clusters where node restart time may be costly.