CVE-2026-102408

Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers catastrophic backtracking, consuming excessive CPU on Elasticsearch worker threads and degrading query throughput for other tenants on the affected node. The cluster does not crash as a result of this issue.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-189/390862	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:elastic:elasticsearch::::::::
	cpe:2.3:a:elastic:elasticsearch::::::::
	cpe:2.3:a:elastic:elasticsearch::::::::

History

13 Oct 2026, 18:48

Type	Values Removed	Values Added
CPE		cpe:2.3:a:elastic:elasticsearch::::::::
First Time		Elastic elasticsearch Elastic
References	~~() https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-189/390862 -~~	() https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-189/390862 - Vendor Advisory

06 Oct 2026, 20:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-06 20:17

Updated : 2026-10-13 18:48

NVD link : CVE-2026-102408

Mitre link : CVE-2026-102408

CVE.ORG link : CVE-2026-102408

JSON object : View

Products Affected

elastic

elasticsearch

CWE

CWE-1333

Inefficient Regular Expression Complexity

{"id": "CVE-2026-102408", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-102408", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-06T19:55:55.653697Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@elastic.co", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@elastic.co", "affectedData": [{"vendor": "Elastic", "product": "Elasticsearch", "versions": [{"status": "affected", "version": "8.19.0", "versionType": "semver", "lessThanOrEqual": "8.19.21"}, {"status": "affected", "version": "9.1.0", "versionType": "semver", "lessThanOrEqual": "9.3.8"}, {"status": "affected", "version": "9.4.0", "versionType": "semver", "lessThanOrEqual": "9.4.7"}, {"status": "affected", "version": "9.5.0", "versionType": "semver", "lessThanOrEqual": "9.5.4"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-06T20:17:12.777", "references": [{"url": "https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-189/390862", "tags": ["Vendor Advisory"], "source": "security@elastic.co"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@elastic.co", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers catastrophic backtracking, consuming excessive CPU on Elasticsearch worker threads and degrading query throughput for other tenants on the affected node. The cluster does not crash as a result of this issue."}], "lastModified": "2026-10-13T18:48:04.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63FE0CC1-F119-4FAB-9518-7705F33A7A3D", "versionEndExcluding": "8.19.22", "versionStartIncluding": "8.19.0"}, {"criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1046DBFA-B87B-49E0-A3F8-DFDF8AFFD15C", "versionEndExcluding": "9.4.8", "versionStartIncluding": "9.1.0"}, {"criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "50BF1B31-EF32-4797-8095-EFD00A168D47", "versionEndExcluding": "9.5.5", "versionStartIncluding": "9.5.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@elastic.co"}