CLEANSTART-2026-XB27469: Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (C...
Published Nov 12, 2026
·Updated
Security vulnerability affects the sonarqube package. Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130).
Affected Software
1 affected componentFixes available
cleanstart/sonarqube<26.10.0.133078-r1
26.10.0.133078-r1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/sonarqubeto a version that resolves this vulnerability.Fixed in 26.10.0.133078-r1
Event History
Nov 12, 2026
Advisory Published
via OSV·12:36 AM
Data Sourced
via OSV·12:36 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Does successful exploitation expose or modify data?
The listed CVSS metrics indicate no confidentiality or integrity impact. The impact is limited to availability, with a high availability impact from termination of an Elasticsearch node.
2
Does exploitation require user interaction?
No. The CVSS vector lists user interaction as not required (UI:N).