CVE-2026-103008
Elasticsearch: denial of service
- Risk score
- 44/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 6 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds and serializes geom…
- Affected
- Elasticsearch
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Elasticsearch: Yellow, plan it in. Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configurable, non-default privilege that lets an administrator dele…
The flaws
- CVE-2026-103008: Denial of service (CVSS 6.5 · EPSS 0%)
- CVE-2026-103007: Incorrect authorisation can lead to privilege escalation (CVSS 7.2 · EPSS 0%)
- CVE-2026-82294: Denial of service (CVSS 6.5 · EPSS 0%)
- CVE-2026-82300: Denial of service (CVSS 6.5 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Elasticsearch
Where it stands
- No known exploitation
Connects to
- Same weakness: CWE-674 (CWE-674). 57 other warnings in 30 days
- Same product: Earlier Elasticsearch warnings. 13 in the last 90 days
Why it is Yellow
- CVSS 6.5 medium
References
Original description
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds and serializes geometry values produced by scripted runtime fields. Unlike geometry supplied as text, which is subject to a nesting-depth limit, geometry constructed from a script's output is not bounded. An authenticated user with read access to a single index can submit a request defining such a field with a script that produces a deeply nested structure. Processing this request recurses past the available stack space, causing the affected node to terminate. The node does not recover automatically on all deployments and may require manual intervention to restore service.
Last activity 6 Oct 2026. Patch Forecast updates every hour.