Description

Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and raises a fatal error, terminating the Elasticsearch node process and causing a denial of service for that node. An authenticated user holding only read-only privileges on a single searchable index can trigger the condition with one small search request.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:28.617Z",
  "pubdate": "2026-08-13T20:17:28.617Z",
  "executiveSummary": "A denial of service vulnerability exists in Elasticsearch where configurable input length restrictions are incorrectly omitted for user-supplied patterns within intervals queries.\nThe vulnerability allows an authenticated attacker to trigger unbounded recursion by submitting a deeply nested pattern.\nThis recursive compilation exhausts the thread stack, raising a fatal error that terminates the Elasticsearch node process and results in a denial of service for the affected node.\nThe flaw impacts Elasticsearch installations utilizing intervals queries, posing a significant availability risk.\nExploitation requires authentication with only read-only privileges on a single searchable index, enabling low-privileged users to compromise node stability via a single small search request.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper enforcement of input validation controls within the Elasticsearch query parsing and compilation engine.\nSpecifically, the application fails to apply its configurable input length restrictions to user-supplied patterns accepted via the intervals query component.\nThe vulnerable component is the intervals query pattern compilation logic, which processes nested structures without adequate depth or recursion limits.\nWhen an authenticated attacker with read-only privileges on a single searchable index submits a specially crafted query containing a deeply nested pattern, the compilation engine attempts to process the hierarchy recursively.\nDue to the lack of depth limitation and bypassed input length restrictions, the recursive parsing drives unbounded execution that rapidly consumes available thread stack memory.\nThis exhaustion of the thread stack directly triggers a fatal error within the Java Virtual Machine running the Elasticsearch node.\nThe fatal error forces the abnormal termination of the Elasticsearch node process, successfully causing a localized denial of service.\nNetwork exposure and authentication requirements are limited to authenticated users who possess baseline read-only access to any single searchable index, meaning virtually any valid user account can initiate the attack payload behavior without advanced privileges."
}