CLEANSTART-2026-UG07284: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230)
Security vulnerability affects the sonarqube package. Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/sonarqubeto a version that resolves this vulnerability.Fixed in 26.8.0.126808-r5
Event History
Frequently Asked Questions
Which product should teams treat as affected when triaging this advisory?
The supplied data is internally inconsistent: the software field identifies cleanstart/sonarqube, while the title identifies Elasticsearch. It does not clarify whether Elasticsearch is an embedded dependency, a separate affected component, or a labeling error.
Are affected versions, fixed versions, or workaround details available?
No affected version range, fixed version, patch information, or mitigation is provided in the supplied data.
What access or input does an attacker need to trigger the denial of service?
The supplied data identifies serialized data with nested payloads as the trigger category, but does not state how such data reaches the affected component or what authentication, network access, or privileges are required.