CVE-2026-102409: Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Published Oct 6, 2026
·Updated
Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130).
Affected Software
3 affected components
Elastic Elasticsearch
Elastic Elasticsearch>=9.2.0<9.4.8
Elastic Elasticsearch>=9.5.0<9.5.5
Event History
Oct 6, 2026
CVE Published
via MITRE·07:31 PM
Data Sourced
via MITRE·07:31 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
An attacker must be authenticated to Elasticsearch and have low privileges. No user interaction is required.
2
What is the expected impact if exploitation succeeds?
Exploitation can terminate an Elasticsearch node, causing a denial of service. The provided severity vector indicates no confidentiality or integrity impact.