CVE-2026-63144

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that terminates the affected node. In single-node deployments, this results in complete service outage; in multi-node clusters, it causes repeated node restarts and sustained availability degradation.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-68/388571	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:elastic:elasticsearch::::::::
	cpe:2.3:a:elastic:elasticsearch::::::::
	cpe:2.3:a:elastic:elasticsearch::::::::

History

24 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Recursión Incontrolada (CWE-674) en Elasticsearch puede llevar a una denegación de servicio a través de una solicitud de búsqueda especialmente diseñada enviada por un usuario autenticado con privilegios bajos. Un usuario con acceso de lectura al índice puede enviar una solicitud que desencadena un procesamiento recursivo ilimitado dentro del componente de evaluación de consultas de Elasticsearch, causando un error fatal que termina el nodo afectado. En implementaciones de un solo nodo, esto resulta en una interrupción completa del servicio; en clústeres de varios nodos, causa reinicios repetidos de nodos y una degradación sostenida de la disponibilidad.

Information

Published : 2026-07-21 23:18

Updated : 2026-10-24 17:10

NVD link : CVE-2026-63144

Mitre link : CVE-2026-63144

CVE.ORG link : CVE-2026-63144

JSON object : View

Products Affected

elastic

elasticsearch

CWE

CWE-674

Uncontrolled Recursion

{"id": "CVE-2026-63144", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63144", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T13:23:19.625583Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@elastic.co", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@elastic.co", "affectedData": [{"vendor": "Elastic", "product": "Elasticsearch", "versions": [{"status": "affected", "version": "9.4.0", "versionType": "semver", "lessThanOrEqual": "9.4.3"}, {"status": "affected", "version": "9.3.0", "versionType": "semver", "lessThanOrEqual": "9.3.7"}, {"status": "affected", "version": "8.19.0", "versionType": "semver", "lessThanOrEqual": "8.19.18"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-21T23:18:02.343", "references": [{"url": "https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-68/388571", "tags": ["Vendor Advisory"], "source": "security@elastic.co"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@elastic.co", "description": [{"lang": "en", "value": "CWE-674"}]}], "descriptions": [{"lang": "en", "value": "Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that terminates the affected node. In single-node deployments, this results in complete service outage; in multi-node clusters, it causes repeated node restarts and sustained availability degradation."}, {"lang": "es", "value": "Recursi\u00f3n Incontrolada (CWE-674) en Elasticsearch puede llevar a una denegaci\u00f3n de servicio a trav\u00e9s de una solicitud de b\u00fasqueda especialmente dise\u00f1ada enviada por un usuario autenticado con privilegios bajos. Un usuario con acceso de lectura al \u00edndice puede enviar una solicitud que desencadena un procesamiento recursivo ilimitado dentro del componente de evaluaci\u00f3n de consultas de Elasticsearch, causando un error fatal que termina el nodo afectado. En implementaciones de un solo nodo, esto resulta en una interrupci\u00f3n completa del servicio; en cl\u00fasteres de varios nodos, causa reinicios repetidos de nodos y una degradaci\u00f3n sostenida de la disponibilidad."}], "lastModified": "2026-10-24T17:10:00.220", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B6FF2B4B-ED0E-40D0-974A-CC3F6967BDC3", "versionEndExcluding": "8.19.19", "versionStartIncluding": "8.19.0"}, {"criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "700D3B63-7050-4288-A12F-1325B5C808E5", "versionEndExcluding": "9.3.8", "versionStartIncluding": "9.3.0"}, {"criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54F14824-0093-4DA8-95AD-ED8F481722FC", "versionEndExcluding": "9.4.4", "versionStartIncluding": "9.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@elastic.co"}