Elasticsearch 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-201)

Announcements Security Announcements
1

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.

Affected Versions:

  • 8.x: All versions from 8.10.0 up to and including 8.19.23
  • 9.x:
  • All versions from 9.0.0 up to and including 9.4.8
  • All versions from 9.5.0 up to and including 9.5.5

Affected Configurations:

  • Elasticsearch nodes with the remote cluster server interface enabled. This interface accepts API key based remote cluster connections for cross-cluster search and cross-cluster replication. It is disabled by default.

Solutions and Mitigations:

The issue is resolved in versions 8.19.24, 9.4.9, and 9.5.6.

The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the known issues for your target version before upgrading.

For Users that Cannot Upgrade:

Self-hosted

  • If you do not use API key based remote cluster connections, disable the remote cluster server interface. Set remote_cluster_server.enabled to false in elasticsearch.yml on each node and restart the node.
  • If you require the remote cluster server interface, use IP filtering on the remote cluster interface to allow connections only from the addresses of your trusted remote clusters.

Indicators of Compromise (IOC)

An unexpected Elasticsearch node termination with a fatal stack overflow or out-of-memory error logged while the node processes a connection on the remote cluster server interface can indicate an exploitation attempt.

Elastic Cloud Serverless

Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.

Severity: CVSSv3.1: High ( 7.5 ) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE ID: CVE-2026-115290
Problem Type: CWE-674 - Uncontrolled Recursion
Impact: CAPEC-230 - Serialized Data with Nested Payloads