CVE-2026-103006

Elasticsearch: denial of service

Risk score: 46/100
CVSS: 6.5 v3.1
Exploit chance (30 days): 0.4%
Published: 6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated user with read access t…
Affected: Elasticsearch
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Elasticsearch: Yellow, plan it in. Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator dele…

The flaws

CVE-2026-103006: Denial of service (CVSS 6.5 · EPSS 0%)
CVE-2026-103007: Incorrect authorisation can lead to privilege escalation (CVSS 7.2 · EPSS 0%)
CVE-2026-82294: Denial of service (CVSS 6.5 · EPSS 0%)
CVE-2026-82300: Denial of service (CVSS 6.5 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Elasticsearch

Where it stands

No known exploitation

Connects to

Same weakness: CWE-674 (CWE-674). 56 other warnings in 30 days
Same product: Earlier Elasticsearch warnings. 13 in the last 90 days

Why it is Yellow

CVSS 6.5 medium

References

https://discuss.elastic.co/t/elasticsearch-8-19-21-9-4-6-9-5-2-security-update-esa-2026-196/390870

Original description

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated user with read access to a single index can submit a specially crafted request containing deeply nested aggregation definitions. Processing this request triggers unbounded recursive execution that exhausts the server process's available resources, causing the affected node to terminate. The node does not recover automatically and requires manual intervention to restore service.

Last activity 6 Oct 2026. Patch Forecast updates every hour.