Uncontrolled Recursion Vulnerability in Elasticsearch by Elastic
CVE-2026-115290

7.5HIGH

Key Information:

Vendor

Elastic
Status
Elastic
Vendor
CVE Published:
3 November 2026

What is CVE-2026-115290?

An uncontrolled recursion vulnerability in Elasticsearch can lead to a denial of service through serialized data with nested payloads. Attackers with network access to the cluster's server interface can craft malicious requests that may cause the node to terminate. Since no authentication is needed, these requests can be executed repeatedly against every reachable node, compromising system availability.

Affected Version(s)

Elasticsearch 8.10.0 <= 8.19.23

Elasticsearch 9.0.0 <= 9.4.8

Elasticsearch 9.5.0 <= 9.5.5

References

https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.