CVE-2026-63144: Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that terminates the affected node. In single-node deployments, this results in complete service outage; in multi-node clusters, it causes repeated node restarts and sustained availability degradation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63144?
The severity of CVE-2026-63144 is medium, rated at 6.5.
What type of vulnerability is CVE-2026-63144?
CVE-2026-63144 is an uncontrolled recursion vulnerability that can cause denial of service.
How does CVE-2026-63144 exploit work?
CVE-2026-63144 allows a low-privileged authenticated user to submit a specially crafted search request that leads to unbounded recursive processing.
Who is affected by CVE-2026-63144?
CVE-2026-63144 affects users with read-level index access in Elasticsearch.
How can I mitigate the risk of CVE-2026-63144?
To mitigate the risk of CVE-2026-63144, ensure that only authorized users have read-level index access and monitor for unusual request patterns.