Description

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth check, exhausting the thread stack and terminating the affected node.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:24.310Z",
  "pubdate": "2026-08-13T20:17:24.310Z",
  "executiveSummary": "An Uncontrolled Recursion vulnerability, classified as CWE-674, has been identified in Elasticsearch. This flaw enables attackers to execute a Denial of Service (DoS) attack via Input Data Manipulation (CAPEC-153).\nThe vulnerability allows an authenticated user possessing only low-privileged index creation permissions to compromise the availability of targeted nodes.\nBy submitting a single request containing a specially crafted and malformed custom analysis definition, an attacker can trigger recursive resolution processes that lack proper cycle or depth checks.\nThis unrestricted recursion results in thread stack exhaustion, subsequently forcing the termination of the affected Elasticsearch node.\nThe primary risk implication is operational disruption and service downtime, which can impact cluster stability and availability.\nExploitation requires authentication and specific low-level index creation privileges, but does not necessitate advanced administrative access.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate bounds checking, specifically the absence of depth limits or cycle detection mechanisms during the recursive resolution of custom analysis definitions within Elasticsearch.\nThe vulnerable component is responsible for parsing and resolving custom analysis configurations submitted as part of index creation or configuration requests.\nAttack execution begins when an authenticated user with low-privileged index creation permissions crafts a malicious request housing a specifically structured, malformed custom analysis definition.\nUpon receiving the payload, the parsing engine processes the malformed definition recursively without validating the depth of the call stack or tracking circular references.\nAs the recursive function executes deeper into the nested structure, it continuously consumes stack memory frames for local variables and function call states.\nThis uncontrolled resource consumption rapidly exhausts the allocated thread stack space for the execution thread.\nConsequently, the Java Virtual Machine (JVM) encounters a StackOverflowError, which terminates the affected Elasticsearch node to prevent memory corruption, leading to a localized Denial of Service.\nIf the node holds critical cluster roles or primary shards, the termination can cascade or degrade cluster performance and availability further.\nThe attack vector requires network access to the Elasticsearch cluster interface, valid authentication credentials, and permissions to create indices."
}