Description

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without a depth limit, exhausting the thread stack and terminating the affected node.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:25.043Z",
  "pubdate": "2026-08-13T20:17:25.043Z",
  "executiveSummary": "An Uncontrolled Recursion vulnerability (CWE-674) affecting Elasticsearch allows an authenticated attacker to trigger a denial of service (DoS) via Serialized Data with Nested Payloads (CAPEC-230).\nThe vulnerability impacts Elasticsearch by allowing a low-privileged user to exhaust thread stack resources, ultimately terminating the affected cluster node.\nThe risk implication is critical availability disruption, as a single malicious request can crash a cluster node without requiring administrative privileges.\nAttacker capabilities require authentication and holding only read privileges on a single index, demonstrating a low barrier to entry for internal or compromised low-privilege accounts.\nExploitation requirements involve submitting a specially crafted search request containing a deeply nested structure that bypasses depth limits during processing.",
  "technicalDetails": "The root cause of the vulnerability lies in the lack of adequate depth limitation checks when parsing search requests containing serialized data with nested payloads.\nThe vulnerable component handles recursive parsing of search queries, failing to enforce a strict maximum recursion depth threshold.\nAuthentication requirements dictate that the attacker must possess valid credentials.\nPrivilege requirements are minimal, as the attacker needs only read privileges on a single index to execute the malicious search request.\nNetwork exposure involves the standard Elasticsearch query interface where authenticated users submit search operations.\nPayload behavior centers on the submission of a specially crafted search request characterized by an excessively deep nested structure.\nThe step-by-step attack flow begins with the authenticated attacker authenticating to the Elasticsearch cluster using low-privileged read credentials.\nNext, the attacker transmits the crafted search payload containing deep nesting to the target index.\nUpon receipt, the query processing engine recursively parses the nested payload without enforcing depth constraints.\nEach recursive function call consumes thread stack memory frames.\nThe lack of a recursion limit causes the continuous allocation of stack frames until the thread stack is completely exhausted.\nThis resource exhaustion directly results in a stack overflow exception, abruptly terminating the affected Elasticsearch node and leading to a denial of service condition."
}