Elasticsearch 8.19.x < 8.19.22 / 9.1.x / 9.3.8 / 9.4.x < 9.4.8 / 9.5.x < 9.5.5 DoS (ESA-2026-189)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(364384);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/09");

  script_cve_id("CVE-2026-102408");
  script_xref(name:"IAVA", value:"2026-A-1094");

  script_name(english:"Elasticsearch 8.19.x < 8.19.22 / 9.1.x / 9.3.8 / 9.4.x < 9.4.8 / 9.5.x < 9.5.5 DoS (ESA-2026-189)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Elasticsearch installed on the remote host is prior to 8.19.22, 9.4.8, or 9.5.5. It is, therefore,
affected by a vulnerability as referenced in the ESA-2026-189 advisory.

  - Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via
    Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy
    accepts a list of user-supplied regular expressions used as text-splitting separators, without validating
    their computational complexity or bounding their execution time. An authenticated user with read access to
    any text-based index can submit a specially crafted regular expression that triggers catastrophic
    backtracking, consuming excessive CPU on Elasticsearch worker threads and degrading query throughput for
    other tenants on the affected node. The cluster does not crash as a result of this issue.
    (CVE-2026-102408)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://discuss.elastic.co/t/390862");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Elasticsearch version 9.4.8, or 9.5.5 or later as appropriate for your release branch.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-102408");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/10/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/09");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elasticsearch:elasticsearch");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:elastic:elasticsearch");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("elasticsearch_detect.nbin", "elastic_elasticsearch_nix_installed.nbin");
  script_require_keys("installed_sw/Elasticsearch");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  "metadata": {
    "spec_version": "1.0"
  },
  "checks": [
    {
      "product": {
        "name": "Elasticsearch",
        "type": "app"
      },
      "check_algorithm": "default",
      "constraints": [
        {
          "min_version": "8.19.0",
          "fixed_version": "8.19.22"
        },
        {
          "min_version": "9.1.0",
          "max_version": "9.3.8",
          "fixed_display": "See vendor advisory"
        },
        {
          "min_version": "9.4.0",
          "fixed_version": "9.4.8"
        },
        {
          "min_version": "9.5.0",
          "fixed_version": "9.5.5"
        }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);