Elasticsearch: Denial of service via uncontrolled recursion (CVE-2026-115290)

Elasticsearch is vulnerable to uncontrolled recursion (CWE-674) when processing serialized data containing nested payloads. An unauthenticated attacker with network access to the cluster interface of a node can send a specially crafted request to trigger the flaw. Successful exploitation leads to a denial of service (DoS) by causing the target node to terminate. This attack does not require authentication and can be repeated against any reachable nodes in the cluster.

Impact

The vulnerability allows an unauthenticated remote attacker to cause a denial of service by forcing the termination of Elasticsearch nodes. The attack is repeatable against every node reachable over the network.

Recommendation

• Upgrade Elasticsearch to a patched version once released by Elastic.
• Restrict network access to the Elasticsearch management/cluster interfaces to trusted IP ranges only via host or network firewalls to prevent unauthorized access by potential attackers.
• Monitor cluster logs and system metrics for unexpected node termination or recursive stack overflow errors during request processing.