# Elasticsearch 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-201)

**URL:** <https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356>\
**Category:** Security Announcements\
**Created:** [November 3, 2026, 4:26pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356 "2026-11-03T16:26:52Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![Bryan\_Garcia](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bryan_garcia/32/148179_2.png) [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\
**Post date:** [November 3, 2026, 4:26pm UTC](https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356/1 "2026-11-03T16:26:52Z")

</div>

**Uncontrolled Recursion in Elasticsearch Leading to Denial of Service**

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.

**Affected Versions:**

> - 8.x: All versions from 8.10.0 up to and including 8.19.23
> - 9.x:

- All versions from 9.0.0 up to and including 9.4.8
- All versions from 9.5.0 up to and including 9.5.5

**Affected Configurations:**

> - Elasticsearch nodes with the remote cluster server interface enabled. This interface accepts API key based remote cluster connections for cross-cluster search and cross-cluster replication. It is disabled by default.

**Solutions and Mitigations:**

The issue is resolved in versions 8.19.24, 9.4.9, and 9.5.6.

The versions above are the first releases verified to contain the fix. Elastic recommends upgrading to one of these fixed versions or a later release verified to contain the fix, and reviewing the [known issues](https://www.elastic.co/docs/release-notes) for your target version before upgrading.

**For Users that Cannot Upgrade:**

**Self-hosted**

> - If you do not use API key based remote cluster connections, disable the remote cluster server interface. Set remote\_cluster\_server.enabled to false in elasticsearch.yml on each node and restart the node.
> - If you require the remote cluster server interface, use IP filtering on the remote cluster interface to allow connections only from the addresses of your trusted remote clusters.

**Indicators of Compromise (IOC)**

An unexpected Elasticsearch node termination with a fatal stack overflow or out-of-memory error logged while the node processes a connection on the remote cluster server interface can indicate an exploitation attempt.

**Elastic Cloud Serverless**

Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.

**Severity:** CVSSv3.1: High ( 7.5 ) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H  
**CVE ID:** CVE-2026-115290  
**Problem Type:** CWE-674 - Uncontrolled Recursion  
**Impact:** CAPEC-230 - Serialized Data with Nested Payloads

---

_[View the full topic](https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356)._