Uncontrolled Recursion Vulnerability in Elasticsearch by Elastic.

CVE-2026-103008

What is CVE-2026-103008?

A vulnerability exists in Elasticsearch that allows for uncontrolled recursion due to how the system constructs and serializes geometry values via scripted runtime fields. This issue enables authenticated users to issue specially crafted requests that result in deeply nested data structures. Since there is no limit on the recursion depth for these structures, processing them can exhaust the server's stack space, leading to a denial of service. Affected nodes may fail to recover automatically, necessitating manual intervention to restore service.

References