Description

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation causes the thread to exhaust its stack. The resulting fatal error is not handled by the surrounding execution paths and terminates the affected node process, producing a denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:29.343Z",
  "pubdate": "2026-08-13T20:17:29.343Z",
  "executiveSummary": "A stack exhaustion vulnerability exists in Elasticsearch, specifically within an internal component responsible for validating user-supplied input.\nThe flaw allows a low-privileged authenticated user to trigger a denial of service (DoS) against the affected system by submitting a single maliciously crafted request.\nThe root cause stems from a recursive validation routine that fails to enforce length bounds on the validated input, causing excessive stack frame consumption.\nThe resulting unhandled fatal error terminates the affected node process, leading to service disruption.\nThe risk implication is high availability degradation for targeted clusters, driven by low operational barriers since the attacker requires only low-privileged authentication and the ability to transmit a single crafted input payload.",
  "technicalDetails": "The vulnerability resides in an internal component of Elasticsearch that processes and validates user-supplied input strings.\nWhen a low-privileged authenticated user submits a crafted request, the vulnerable component passes the input to a recursive validation routine.\nThis routine lacks length bounds or depth checks on the input being evaluated.\nConsequently, processing a deeply nested or excessively long crafted value forces the routine to continuously allocate new stack frames.\nThis unchecked recursion rapidly exhausts the thread's allocated stack memory, culminating in a stack overflow condition.\nThe execution context fails to intercept or handle the resulting fatal error, which forces the Java Virtual Machine (JVM) or the affected node process to terminate abnormally.\nThe attack vector is network-based, requiring the attacker to authenticate with low privileges and submit a single HTTP or transport-layer request containing the payload.\nPost-exploitation impact is limited to a denial of service through node termination, but repeated exploitation can prevent cluster stabilization and impact overall data availability."
}