CVE-2026-102408 in Elasticsearch
Summary
by MITRE • 10/06/2026
Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers catastrophic backtracking, consuming excessive CPU on Elasticsearch worker threads and degrading query throughput for other tenants on the affected node. The cluster does not crash as a result of this issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in Elasticsearch represents a critical instance of Inefficient Regular Expression Complexity, categorized under CWE-1333. This flaw specifically affects the ES|QL CHUNK function, which is designed to split text data based on user-provided delimiters. The core technical deficiency lies in the absence of input validation regarding the computational complexity of these regular expressions and the lack of mechanisms to bound their execution time. By accepting arbitrary regex patterns without analyzing them for potential inefficiencies, the system exposes itself to Regular Expression Exponential Blowup, a known attack vector classified as CAPEC-492. This architectural oversight allows malicious actors to exploit the inherent unpredictability of backtracking algorithms used in most regular expression engines.
An authenticated user possessing read access to any text-based index can leverage this weakness by submitting specially crafted regular expressions designed to trigger catastrophic backtracking. When such a pattern is processed, it forces the regex engine into an exponential time complexity scenario relative to the input length. This results in excessive CPU consumption on Elasticsearch worker threads as they attempt to resolve the matching process. The impact is not limited to the immediate query; rather, it degrades overall cluster performance by monopolizing resources that are shared among multiple tenants operating on the same node. Consequently, legitimate queries from other users experience significant latency and reduced throughput, effectively creating a denial of service condition for the broader system despite the application itself remaining operational and not crashing.
From an operational perspective, this vulnerability undermines the availability aspect of the CIA triad within multi-tenant Elasticsearch deployments. Since the cluster does not crash, traditional monitoring tools that rely on process termination or node unavailability may fail to detect the attack immediately. Instead, symptoms manifest as gradual performance degradation, increased latency for standard queries, and elevated CPU utilization metrics. This makes detection more challenging compared to crashes, requiring administrators to monitor resource usage patterns closely rather than relying solely on service health checks. The ability of a single authenticated user with minimal privileges to impact system-wide performance highlights the severity of privilege escalation risks associated with this flaw.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Elasticsearch should implement strict validation rules for regular expressions passed to the CHUNK function, potentially by restricting allowed characters or patterns that are known to cause backtracking issues. Additionally, introducing execution time limits or resource quotas for regex operations would prevent any single query from monopolizing worker threads indefinitely. Administrators can also mitigate risk by limiting read access to sensitive indices and enforcing least-privilege principles across user accounts. Upgrading to patched versions of Elasticsearch where this vulnerability has been addressed is the primary defense mechanism, ensuring that input sanitization and complexity checks are enforced before regex execution begins.