CVE-2026-115290 in Elasticsearch
Summary
by MITRE • 11/03/2026
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified as Uncontrolled Recursion, classified under CWE-674 within Elasticsearch, represents a critical flaw in how the application handles serialized data containing deeply nested structures. This issue specifically exploits the mechanism for processing complex payloads that are designed to trigger recursive function calls without adequate depth limits or stack overflow protections. When an attacker submits a specially crafted request utilizing Serialized Data with Nested Payloads, as described by CAPEC-230, the Elasticsearch node attempts to deserialize and process this input. The lack of proper validation on the nesting level causes the application to enter an infinite loop or consume excessive memory resources rapidly during the recursive execution phase. This behavior is not isolated to a single endpoint but affects the core serialization logic used across various cluster communication channels, making it a pervasive threat vector within the distributed architecture.
From an operational perspective, this flaw leads directly to a severe denial of service condition. Because no credentials are required for exploitation, any unauthenticated actor with network access to the remote cluster server interface can initiate the attack. The immediate consequence is that the targeted node terminates unexpectedly due to resource exhaustion or stack overflow errors triggered by the recursive processing loop. In an Elasticsearch cluster, where nodes rely on continuous communication and data synchronization, the termination of a single node can disrupt indexing operations, degrade search performance for remaining nodes, and potentially lead to data inconsistency if shard replication fails during the outage. An attacker can systematically repeat this request against each reachable node in the cluster, effectively taking down the entire service infrastructure without needing any prior authentication or privileged access.
The attack vector leverages the inherent trust placed in serialized objects within Java-based applications like Elasticsearch. By crafting a payload that forces deep recursion, the adversary bypasses standard input validation checks that might otherwise reject malformed data based on size alone. The recursive nature of the flaw means that even relatively small payloads can cause disproportionate resource consumption as the call stack expands exponentially until system limits are breached. This characteristic makes the vulnerability particularly dangerous in high-throughput environments where rapid request processing is prioritized, as the time to exploit and achieve denial of service is minimal.
Mitigation strategies must focus on immediate remediation through software updates provided by Elasticsearch vendors, which typically include patches that enforce strict recursion depth limits or implement safer deserialization practices such as allowing lists only for specific classes. In the interim, network-level controls should be implemented to restrict access to the cluster server interface from untrusted networks. Deploying web application firewalls with rules capable of detecting and blocking deeply nested JSON structures can provide a layer of defense against this specific attack pattern. Additionally, monitoring system logs for signs of stack overflow errors or unexpected node terminations is essential for early detection and rapid incident response in environments where patching cannot be applied immediately.