CVE-2026-115290

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230. An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate...

CVE-2026-115290 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230. An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate...

CVE-2026-115290

Elasticsearch is vulnerable to a Denial of Service (DoS) attack due to Uncontrolled Recursion (CWE-674) involving Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to a node's remote cluster server interface can send a specially crafted request caus...

CVE-2026-115290 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230. An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate...

EUVD-2026-116072

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230. An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate...

Elasticsearch 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-201)

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230. An unauthenticated attacker with network access to the remote cluster server interface of a node c...

PT-2026-136276

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Uncontrolled recursion occurs in the Remote Cluster Server Interface when processing serialized data with nested payloads. An unauthenticated attacker with network access to the interfa...

Elasticsearch 8.10.x < 8.19.24 / 9.0.x < 9.4.9 / 9.5.x < 9.5.6 DoS (ESA-2026-201)

The version of Elasticsearch installed on the remote host is 8.10.x prior to 8.19.24, or 9.0.x prior to 9.4.9, or 9.5.x prior to 9.5.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-201 advisory. - Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of...