Is CVE-2026-115290 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-115290 being exploited in the wild.

How severe is CVE-2026-115290?

High severity, with a CVSS score of 7.5, published 3 November 2026.

Which products and versions are affected?

Elasticsearch 8.10.0–8.19.23, 9.0.0–9.4.8, 9.5.0–9.5.5.

How is CVE-2026-115290 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-115290?

Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-115290: Elasticsearch uncontrolled recursion denial of service

CVE-2026-115290 · Severity: high · CVSS 7.5 · Published 2026-11-03

Elasticsearch, a widely-used search and analytics platform, contains a vulnerability in its remote cluster server interface that can be exploited by unauthenticated attackers on the network to crash individual nodes. An attacker can send specially crafted requests to cause a node to terminate, and can repeat this attack against multiple nodes to disrupt the entire cluster's availability.

Technologies: Elasticsearch. Vendors: Elastic.

Quick answers

Is CVE-2026-115290 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-115290 being exploited in the wild.
How severe is CVE-2026-115290?: High severity, with a CVSS score of 7.5, published 3 November 2026.
Which products and versions are affected?: Elasticsearch 8.10.0–8.19.23, 9.0.0–9.4.8, 9.5.0–9.5.5.
Is there a fix for CVE-2026-115290?: Yes: fixed in Elasticsearch 8.19.24, 9.4.9, 9.5.6. Until then: If you do not use API key-based remote cluster connections, disable the remote cluster server interface by setting remote_cluster_server.enabled to false in elasticsearch.yml on each node and restarting. If the interface is required, use IP filtering on the remote cluster interface to allow connections only from trusted remote cluster addresses.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-11-03", "note": "CVE-2026-115290 published" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-115290 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-115290?: Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Elasticsearch 8.19.24, 9.4.9, 9.5.6

If you do not use API key-based remote cluster connections, disable the remote cluster server interface by setting remote_cluster_server.enabled to false in elasticsearch.yml on each node and restarting. If the interface is required, use IP filtering on the remote cluster interface to allow connections only from trusted remote cluster addresses.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-11-03", "note": "CVE-2026-115290 published" } ]

Technical details

Uncontrolled recursion (CWE-674) in Elasticsearch allows unauthenticated attackers with network access to the remote cluster server interface to trigger denial of service via nested payload serialization. The vulnerability affects the remote cluster server interface (disabled by default), which processes API key-based cross-cluster connections; an attacker sends a specially crafted request that causes a fatal stack overflow or out-of-memory error, terminating the node.

Affected products

Elastic Elasticsearch 8.10.0–8.19.23, 9.0.0–9.4.8, 9.5.0–9.5.5

References

https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.