Aller au contenu
en Se connecter
6.5 Moyenne

CVE-2026-103006 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested…

Description

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated user with read access to a single index can submit a specially crafted request containing deeply nested aggregation definitions. Processing this request triggers unbounded recursive execution that exhausts the server process's available resources, causing the affected node to terminate. The node does not recover automatically and requires manual intervention to restore service.

Produits et versions touchés

Produit Versions touchées Corrigé en
Elasticsearch 9.5 9.5.0 → 9.5.1 Pas de correctif indiqué
Elasticsearch 9.0 9.0.0 → 9.4.5 Pas de correctif indiqué
Elasticsearch 8.0 8.0.0 → 8.19.20 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Elasticsearch

Les 91 CVE de Elasticsearch →
CVE-2026-115715 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a… 6.5 Moyenne CVE-2026-115710 Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and… 4.2 Moyenne CVE-2026-115298 Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not… 4.3 Moyenne CVE-2026-115290 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads… 7.5 Élevée
Suivre cette CVE