CVE-2026-115290

EUVD-2026-116072
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
elasticCNA
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
elasticelasticsearch
8.10.0 ≤
𝑥
≤ 8.19.23
CNA
elasticelasticsearch
9.0.0 ≤
𝑥
≤ 9.4.8
CNA
elasticelasticsearch
9.5.0 ≤
𝑥
≤ 9.5.5
CNA
Common Weakness Enumeration
References
https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356