Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that terminates the affected node. In single-node deployments, this results in complete service outage; in multi-node clusters, it causes repeated node restarts and sustained availability degradation.
Affected Versions:
- 8.x: All versions from 8.19.0 up to and including 8.19.18
- 9.x:
- All versions from 9.3.0 up to and including 9.3.7
- All versions from 9.4.0 up to and including 9.4.3
Users on the 9.5.x release line are not affected. The fix was included in 9.5.0, the initial release of this line, before it was publicly available.
Affected Configurations:
- All Elasticsearch deployments are affected. Any user with read-level index access and the ability to execute search queries can trigger this vulnerability. No special or non-default configuration is required.
Solutions and Mitigations:
The issue is resolved in versions 8.19.19, 9.3.8, and 9.4.4.
For Users that Cannot Upgrade:
- There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE ID: CVE-2026-63144
Problem Type: CWE-674 - Uncontrolled Recursion