Executive brief
Elasticsearch, a widely-used search and analytics engine, contains a flaw in how it processes custom analysis definitions when creating indexes. An attacker with permissions to create indexes can submit a malformed configuration that causes the system to recursively process the same data without proper safety checks, exhausting server memory and crashing the affected node, resulting in service disruption.
Technical details
The vulnerability is an uncontrolled recursion issue (CWE-674) in Elasticsearch's custom analysis definition parsing logic. When an authenticated user with low-privileged index creation permissions submits a request containing a specially crafted, malformed analysis definition, the system attempts to resolve it recursively without cycle detection or depth limits. This exhausts the thread stack, causing an out-of-memory condition that terminates the affected Elasticsearch node. The attack requires network access and valid authentication credentials with index creation privileges, but no additional user interaction. Patches are available in Elasticsearch 8.19.20 and 9.4.5; no workarounds exist for unpatched versions.
Affected products
- Elastic Elasticsearch 8.0.0 through 8.19.19, 9.0.0 through 9.4.4
Timeline
- 2026-08-13: disclosed
- 2026-08-13: patched: Fixed in Elasticsearch 8.19.20 and 9.4.5