Description
Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Elastic | Elasticsearch | 9.2.0 – ≤ 9.2.8, 9.3.0 – ≤ 9.3.8, 9.4.0 – ≤ 9.4.7, 9.5.0 – ≤ 9.5.4 | — |
Advisories 1
- WID-SEC-2026-3784 Elasticsearch: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 13, 2026