{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aelasticelasticsearch/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-115290"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Elasticsearch"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","cve-2026-115290","elasticsearch"],"_cs_type":"advisory","_cs_vendors":["Elastic"],"content_html":"\u003cp\u003eElasticsearch is vulnerable to uncontrolled recursion (CWE-674) when processing serialized data containing nested payloads. An unauthenticated attacker with network access to the cluster interface of a node can send a specially crafted request to trigger the flaw. Successful exploitation leads to a denial of service (DoS) by causing the target node to terminate. This attack does not require authentication and can be repeated against any reachable nodes in the cluster.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an unauthenticated remote attacker to cause a denial of service by forcing the termination of Elasticsearch nodes. The attack is repeatable against every node reachable over the network.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Elasticsearch to a patched version once released by Elastic.\u003c/li\u003e\n\u003cli\u003eRestrict network access to the Elasticsearch management/cluster interfaces to trusted IP ranges only via host or network firewalls to prevent unauthorized access by potential attackers.\u003c/li\u003e\n\u003cli\u003eMonitor cluster logs and system metrics for unexpected node termination or recursive stack overflow errors during request processing.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T20:01:41Z","date_published":"2026-11-03T20:01:41Z","id":"https://feed.craftedsignal.io/briefs/2026-11-elasticsearch-dos/","summary":"Elasticsearch contains an uncontrolled recursion vulnerability (CVE-2026-115290) that allows an unauthenticated attacker to trigger node termination via crafted serialized data with nested payloads.","title":"Elasticsearch: Denial of service via uncontrolled recursion (CVE-2026-115290)","url":"https://feed.craftedsignal.io/briefs/2026-11-elasticsearch-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}