CLEANSTART-2026-XJ19637: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with n...

Q: What access does an attacker need to trigger the denial of service?

The attack is network-accessible, requires low privileges, and does not require user interaction. An attacker can send a specially crafted request that causes deeply nested data to be processed.

Q: What is the expected impact if exploitation succeeds?

The vulnerability affects availability: uncontrolled recursion can cause denial of service. The provided information does not indicate confidentiality or integrity impact.

Published Nov 12, 2026

Updated

Security vulnerability affects the sonarqube package. Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth.

Affected Software

1 affected componentFixes available

cleanstart/sonarqube<26.10.0.133078-r1

26.10.0.133078-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.10.0.133078-r1

Event History

Nov 12, 2026

Advisory Published

via OSV·12:36 AM

Data Sourced

via OSV·12:36 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-103008

Frequently Asked Questions

What access does an attacker need to trigger the denial of service?

The attack is network-accessible, requires low privileges, and does not require user interaction. An attacker can send a specially crafted request that causes deeply nested data to be processed.

What is the expected impact if exploitation succeeds?

The vulnerability affects availability: uncontrolled recursion can cause denial of service. The provided information does not indicate confidentiality or integrity impact.

CLEANSTART-2026-XJ19637: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with n...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What access does an attacker need to trigger the denial of service?

What is the expected impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to trigger the denial of service?

What is the expected impact if exploitation succeeds?