Executive brief
Elasticsearch, a widely-used search and analytics engine, contains a flaw that allows authenticated users with read-only access to trigger a denial of service condition. An attacker can submit a specially crafted search request with deeply nested data structures that exhaust the server's thread stack, crashing the affected node and disrupting search and indexing operations for all users.
Technical details
The vulnerability exists in Elasticsearch's search API retriever framework, which lacks depth limits when processing nested payloads in serialized search queries. An authenticated user with read privileges on any single index can craft a deeply nested search request that triggers uncontrolled recursion, exhausting the thread stack and crashing the affected node. The attack requires only network access, valid authentication credentials (which may be obtained through social engineering or credential theft), and no special user interaction. The issue is resolved in versions 8.19.20, 9.4.5, and 9.5.1; prior versions lack mitigations and should be patched immediately.
Affected products
- Elastic Elasticsearch 8.0.0 to 8.19.19; 9.0.0 to 9.4.4; 9.5.0
Timeline
- 2026-08-13: disclosed