Executive brief
Elasticsearch is a popular search and analytics engine used to store and process large volumes of data. A vulnerability has been identified where an authenticated user can send a specially crafted search query that causes the system to consume excessive resources. This can lead to a denial-of-service condition, making the affected database node unavailable for legitimate business operations.
Technical details
A vulnerability classified as Uncontrolled Recursion (CWE-674) exists in Elasticsearch. The flaw allows an authenticated user with query privileges to submit a specially crafted request that triggers excessive resource allocation (CAPEC-130) during processing. This recursion leads to high CPU or memory consumption, resulting in a denial-of-service (DoS) for the affected node. The attack is reachable over the network and does not require administrative privileges. The issue is resolved in versions 8.19.17, 9.3.6, and 9.4.3.
Affected products
- Elastic Elasticsearch 8.0.0 to 8.19.16, 9.0.0 to 9.3.5, 9.4.0 to 9.4.2
Timeline
- 2026-07-01: disclosed
- 2026-07-01: advisory
- 2026-07-01: patched: Fixed in versions 8.19.17, 9.3.6, and 9.4.3