Description

A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate) to submit a request that causes a self-referential data structure to be created. When a specific internal component later processes that structure, the operation recurses without bound and raises a fatal error that is not handled by the surrounding execution path, terminating the affected node process and resulting in a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:28.973Z",
  "pubdate": "2026-08-13T20:17:28.973Z",
  "executiveSummary": "An unhandled recursion vulnerability exists within Elasticsearch, specifically impacting the simulate pipeline API endpoint. The vulnerability allows an authenticated user with sufficient privileges to invoke the simulate pipeline API endpoint to induce a denial of service condition against the targeted node. The root cause stems from the ability to submit a crafted request that forces the creation of a self-referential data structure within the application logic. When an internal component subsequently evaluates or processes this anomalous structure, it enters an unbounded recursive execution path without proper exception handling or termination guards. This unbounded recursion triggers a fatal error that abruptly terminates the affected Elasticsearch node process, rendering it unavailable. Exploitation of this flaw requires prior authentication and the specific privileges necessary to interact with the simulate pipeline API endpoint. The operational impact is severe, as successful exploitation results in unexpected node termination, cluster disruption, and potential availability degradation depending on cluster topology and failover configurations. No remote code execution or unauthorized data access capabilities are inherently conferred by this vulnerability, restricting the immediate impact strictly to denial of service.",
  "technicalDetails": "The vulnerability resides in the internal data handling and processing routines associated with the Elasticsearch ingest pipeline simulation mechanism, specifically exposed via the simulate pipeline API endpoint located at https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate. The root cause of the flaw is the lack of validation and cycle-detection mechanisms during the parsing and construction of pipeline simulation data structures, enabling the injection or creation of self-referential objects.\nAttack flow and exploitation occur through a multi-step sequence. First, an adversary must authenticate to the Elasticsearch cluster and possess the requisite authorization roles or privileges needed to invoke the simulate pipeline API endpoint. Second, the attacker crafts a malicious input payload specifically designed to construct a circular or self-referential data reference when parsed by the simulate pipeline engine. Third, the attacker transmits this payload in a request to the target API endpoint. Upon receiving the payload, the Elasticsearch node instantiates the internal data representation containing the self-referential loops.\nAt a later point in the execution lifecycle, a specific internal processing component evaluates the populated data structure. Because the traversal algorithm lacks guardrails such as depth tracking or cycle detection (e.g., hash sets tracking visited nodes), the traversal function calls itself recursively without bound. This behavior rapidly exhausts the available call stack space allocated to the thread, resulting in a fatal StackOverflowError or equivalent unhandled execution fault.\nBecause the surrounding execution path lacks appropriate exception handling or error recovery blocks for this specific recursive failure condition, the exception propagates unhandled. This forces the Java Virtual Machine or the surrounding container process to abort, abruptly terminating the affected Elasticsearch node process. Network exposure is dependent on the accessibility of the Elasticsearch REST API interface, and the attack requires active session credentials and specific pipeline simulation privileges to execute."
}