Elastic Elasticsearch ES|QL Chunk redos

Summaryinfo

A vulnerability marked as problematic has been reported in Elastic Elasticsearch. This impacts the function Chunk of the component ES|QL. The manipulation leads to redos. This vulnerability is uniquely identified as CVE-2026-102408. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability was found in Elastic Elasticsearch (the affected version is unknown). It has been rated as problematic. This issue affects the function Chunk of the component ES|QL. The manipulation with an unknown input leads to a redos vulnerability. Using CWE to declare the problem leads to CWE-1333. The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. Impacted is availability. The summary by CVE is:

Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers catastrophic backtracking, consuming excessive CPU on Elasticsearch worker threads and degrading query throughput for other tenants on the affected node. The cluster does not crash as a result of this issue.

It is possible to read the advisory at discuss.elastic.co. The identification of this vulnerability is CVE-2026-102408 since 09/29/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1449.003 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Elastic

Name

• Elasticsearch

License

• free

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion