Description

Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of match operations performed. A search request containing a wildcard pattern with a large number of wildcard groups, evaluated against a sufficiently long name, exhausts the thread stack. Elasticsearch treats a stack overflow as an unrecoverable condition and shuts the node down, so the request terminates the affected node rather than failing gracefully.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:24.187Z",
  "pubdate": "2026-08-13T20:17:24.187Z",
  "executiveSummary": "An uncontrolled recursion vulnerability categorized as CWE-674 exists in the Elasticsearch wildcard matching helper, potentially leading to a denial of service via excessive resource allocation (CAPEC-130). The flaw arises because the matching algorithm used to resolve wildcard patterns against target names lacks bounds on recursion depth and total match operations. Consequently, an attacker can submit a maliciously crafted search request containing an excessive number of wildcard groups evaluated against a sufficiently long name. This exploits the underlying evaluation logic to exhaust the thread stack space. Because Elasticsearch treats fatal thread stack overflows as unrecoverable runtime exceptions, the affected node immediately terminates and shuts down rather than failing the specific request gracefully. This results in a localized denial of service affecting cluster availability. The risk implications include service disruption and potential cascading failures across the Elasticsearch cluster if multiple nodes are targeted concurrently. Exploitation requires the capability to issue search queries containing specially crafted wildcard patterns to the target Elasticsearch instance. No specific authentication or privilege requirements are detailed beyond the ability to execute search operations that trigger the vulnerable wildcard evaluation component.",
  "technicalDetails": "The vulnerability resides within the Elasticsearch wildcard matching helper component, which is responsible for resolving wildcard patterns against field names or indices during query execution. The root cause of the flaw is the recursive implementation of the matcher function, which processes wildcard patterns without enforcing a maximum recursion depth or placing an upper bound on the total number of recursive match operations performed during evaluation. When a search request containing a wildcard pattern with a large number of wildcard groups is processed against a sufficiently long target name, the recursive function continually pushes execution frames onto the thread call stack. Step-by-step, the exploitation flow occurs as follows: first, the attacker crafts a malicious search request embedding an abnormally high density of wildcard operators; second, the search engine routes this query to the wildcard matching helper for pattern resolution; third, the recursive matcher parses the pattern against a long target string, rapidly accumulating stack frames with each nested wildcard group evaluation; fourth, the continuous self-referential function calls exceed the allocated thread stack memory limit, triggering a Java Virtual Machine (JVM) stack overflow error (java.lang.StackOverflowError); fifth, Elasticsearch intercepts this critical JVM error and treats it as an unrecoverable system condition, forcing an immediate, ungraceful shutdown of the affected node to prevent data corruption. The vulnerable component is strictly the wildcard matching helper routine utilized during pattern resolution in search requests. The payload behavior relies entirely on algorithmic complexity and stack exhaustion rather than memory corruption or arbitrary code execution. Network exposure depends on the accessibility of the Elasticsearch search interface, and post-exploitation impact is limited to availability disruption via forced node termination."
}