# CVE-2026-102409: Elasticsearch uncontrolled recursion in text chunking

Source: https://junglewise.ai/threats/cve-2026-102409-uncontrolled-recursion-cwe-674-in-elasticsearch-can-allow-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-102409 · Severity: medium · CVSS 6.5 · Published 2026-10-06

Elasticsearch is a search and analytics engine used to store and query large datasets. An authenticated user with minimal database read permissions can trigger uncontrolled recursion in the text chunking functionality, causing an Elasticsearch node to crash and become unavailable. This results in service disruption and potential data access loss for dependent applications.

Technologies: [Elasticsearch](https://junglewise.ai/threats/technologies/elasticsearch). Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic).

## Quick answers

**Is CVE-2026-102409 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102409 being exploited in the wild.

**How severe is CVE-2026-102409?** Medium severity, with a CVSS score of 6.5, published 6 October 2026.

**Which products and versions are affected?** Elasticsearch 9.2.0–9.2.8, 9.3.0–9.3.8, 9.4.0–9.4.7, 9.5.0–9.5.4.

**Is there a fix for CVE-2026-102409?** Yes: fixed in Elasticsearch 9.4.8, 9.5.5. Until then: No workarounds are available. Users unable to upgrade immediately should disable ES|QL or restrict index read access to high-privileged users only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102409 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-102409?** Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Elasticsearch 9.4.8, 9.5.5

No workarounds are available. Users unable to upgrade immediately should disable ES|QL or restrict index read access to high-privileged users only.

## Technical details

An uncontrolled recursion vulnerability (CWE-674) exists in Elasticsearch's text chunking functionality, introduced in version 9.2.0. When ES|QL is enabled (default configuration), a low-privileged authenticated user can submit a malicious query that triggers excessive recursion, exhausting memory and terminating the node. The vulnerability requires network access and valid credentials but no special privileges.

## Affected products

- Elastic Elasticsearch 9.2.0–9.2.8, 9.3.0–9.3.8, 9.4.0–9.4.7, 9.5.0–9.5.4

## Timeline

- 2026-10-06: disclosed

## References

- [https://discuss.elastic.co/t/elasticsearch-9-4-8-9-5-5-security-update-esa-2026-190/390863](https://discuss.elastic.co/t/elasticsearch-9-4-8-9-5-5-security-update-esa-2026-190/390863)

## Related threats

- [Elasticsearch denial of service in phonetic analysis encoders](https://junglewise.ai/threats/cve-2026-115715-allocation-of-resources-without-limits-or-throttling-cwe-770-in)
- [Elasticsearch cache information disclosure via field-level security bypass](https://junglewise.ai/threats/cve-2026-115710-use-of-cache-containing-sensitive-information-cwe-524-in)
- [Elasticsearch incorrect authorization in field-level security](https://junglewise.ai/threats/cve-2026-115298-incorrect-authorization-cwe-863-in-elasticsearch-can-lead-to)
- [Elasticsearch uncontrolled recursion denial of service](https://junglewise.ai/threats/cve-2026-115290-uncontrolled-recursion-cwe-674-in-elasticsearch-can-lead-to)
- [Elasticsearch authorization bypass in cross-cluster search](https://junglewise.ai/threats/cve-2026-103009-authorization-bypass-through-user-controlled-key-cwe-639-in)