CVE-2026-103006 in Elasticsearch
Summary
by MITRE • 10/06/2026
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated user with read access to a single index can submit a specially crafted request containing deeply nested aggregation definitions. Processing this request triggers unbounded recursive execution that exhausts the server process's available resources, causing the affected node to terminate. The node does not recover automatically and requires manual intervention to restore service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified as CWE-674 represents a critical flaw in Elasticsearch’s search aggregation processing mechanism, specifically manifesting as an uncontrolled recursion issue. This weakness allows for significant disruption of service availability through resource exhaustion attacks. The core technical failure lies within the parser and execution engine responsible for handling complex query structures. When the system processes aggregation definitions, it employs recursive logic to resolve nested data groupings and calculations. However, the implementation lacks sufficient depth limits or stack size constraints on these recursive calls. Consequently, when a request contains deeply nested aggregation structures, the application enters an infinite or excessively deep recursion loop that consumes memory and CPU cycles at an unsustainable rate until the Java Virtual Machine’s thread stack is exhausted.
An attacker with authenticated access possessing read permissions to even a single index can exploit this flaw by constructing a maliciously crafted search request. The payload involves defining aggregations within aggregations, repeated to a depth that exceeds the server's capacity to handle recursive calls without crashing. This does not require administrative privileges or write access, lowering the barrier for exploitation significantly in environments where users are granted read-only roles for data analysis purposes. Upon submission of this specially crafted request, the Elasticsearch node begins processing the nested aggregations. The unbounded recursion rapidly depletes available system resources, leading to a catastrophic failure of the specific node handling the request.
The operational impact of this vulnerability is severe and directly results in a Denial of Service condition for the affected cluster nodes. Unlike typical application errors that might return an error code or gracefully degrade performance, this flaw causes the Java process hosting the Elasticsearch instance to terminate abruptly due to stack overflow exceptions. This termination removes the node from the cluster immediately, potentially triggering data rebalancing and master election processes if the node held critical roles such as Master-eligible or coordinating nodes. The most concerning aspect of this impact is that the affected node does not recover automatically after the crash. It requires manual intervention by system administrators to restart the service, which introduces significant downtime and operational overhead during incident response efforts.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Resource Hijacking or Denial of Service via application layer attacks. The attack vector is classified as Network Access with Authentication Required, indicating that while it can be triggered remotely over the network, valid credentials are necessary. This highlights the importance of strict access control policies within Elasticsearch deployments. Even read-only users should have their capabilities scrutinized to ensure they cannot submit overly complex queries that might trigger such resource exhaustion states.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. The primary defense is applying the official security patches provided by Elastic for the affected versions of Elasticsearch, which implement depth limits or iterative processing models instead of pure recursion to handle nested aggregations. In environments where patching cannot be applied immediately, network-level controls such as Web Application Firewalls can be configured to detect and block requests with unusually deep JSON nesting structures targeting the search API endpoints. Additionally, administrators should enforce strict role-based access control, ensuring that users are granted only the minimum necessary permissions and avoiding granting broad read access unless absolutely required for business operations. Regular auditing of user roles and query complexity limits in Elasticsearch configuration files can further reduce the attack surface associated with this uncontrolled recursion flaw.