CVE-2026-103008— Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Quick assessment
Affected
Elastic Elasticsearch
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Elasticsearch 中存在非受控递归漏洞（CWE-674），攻击者可利用特制的请求导致拒绝服务（DoS）。该漏洞源于 Elasticsearch 在构建和序列化由脚本运行时字段生成的几何值时，对递归深度缺乏有效限制。 与作为文本提供的几何数据（其嵌套深度受到限制）不同，由脚本输出构建的几何数据未设置任何递归深度上限。具有读取单个索引权限的认证用户，可以提交一个定义此类字段的请求，并使用脚本生成深度嵌套的数据结构。处理该请求时，系统会因递归过深而耗尽可用栈空间，从而导致受影响的节点崩溃。在某些部署环境中，节点
Possible ATT&CK Techniques 1 AI
T1499.002 · Service Exhaustion FloodAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Elastic | Elasticsearch | 8.12.0≤ 8.19.22 |
affected |
9.0.0≤ 9.4.7 |
affected | ||
9.5.0≤ 9.5.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-103008
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Source: CVE Program / CVE List V5
Vulnerability Description
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds and serializes geometry values produced by scripted runtime fields. Unlike geometry supplied as text, which is subject to a nesting-depth limit, geometry constructed from a script's output is not bounded. An authenticated user with read access to a single index can submit a request defining such a field with a script that produces a deeply nested structure. Processing this request recurses past the available stack space, causing the affected node to terminate. The node does not recover automatically on all deployments and may require manual intervention to restore service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的递归
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Elastic | Elasticsearch | 8.12.0 ~ 8.19.22 | - |
|
II. Public POCs for CVE-2026-103008
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-103008
请登录查看更多情报信息。
Other References for CVE-2026-103008 (1)
Same Patch Batch · Elastic · 2026-10-06 · 14 CVEs total
| CVE-2026-102406 | 8.8 HIGH | Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data In |
| CVE-2026-103007 | 7.2 HIGH | Incorrect Authorization in Elasticsearch Leading to Privilege Escalation |
| CVE-2026-103009 | 7.1 HIGH | Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information D |
| CVE-2026-102412 | 6.5 MEDIUM | Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure |
| CVE-2026-102409 | 6.5 MEDIUM | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service |
| CVE-2026-102411 | 6.5 MEDIUM | Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of |
| CVE-2026-102404 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service |
| CVE-2026-103005 | 6.5 MEDIUM | Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service |
| CVE-2026-103006 | 6.5 MEDIUM | Uncontrolled Recursion in Elasticsearch Leading to Denial of Service |
| CVE-2026-102413 | 6.2 MEDIUM | Uncaught Exception in Elastic Endpoint Leading to Denial of Service |
| CVE-2026-102407 | 5.4 MEDIUM | Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification |
| CVE-2026-102410 | 4.3 MEDIUM | Missing Authorization in Kibana Leading to Information Disclosure |
| CVE-2026-102408 | 4.3 MEDIUM | Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service |
IV. Related Vulnerabilities
Same product: Elasticsearch
-
CVE-2026-103009
Authorization Bypass Through User-Controlled Key in Elastics -
CVE-2026-103007
Incorrect Authorization in Elasticsearch Leading to Privileg -
CVE-2026-103006
Uncontrolled Recursion in Elasticsearch Leading to Denial of -
CVE-2026-103005
Memory Allocation with Excessive Size Value in Elasticsearch -
CVE-2026-102411
Allocation of Resources Without Limits or Throttling in Elas
Same vendor: Elastic
-
CVE-2026-103009
Authorization Bypass Through User-Controlled Key in Elastics -
CVE-2026-103007
Incorrect Authorization in Elasticsearch Leading to Privileg -
CVE-2026-103006
Uncontrolled Recursion in Elasticsearch Leading to Denial of -
CVE-2026-103005
Memory Allocation with Excessive Size Value in Elasticsearch -
CVE-2026-102413
Uncaught Exception in Elastic Endpoint Leading to Denial of
Same weakness: CWE-674
-
CVE-2026-106449
yawkat LZ4 Java: LZ4BlockInputStream with stopOnEmptyBlock=f -
CVE-2026-106447
StableLib: Stack exhaustion denial of service via deeply nes -
CVE-2026-103006
Uncontrolled Recursion in Elasticsearch Leading to Denial of -
CVE-2026-102409
Uncontrolled Recursion in Elasticsearch Leading to Denial of -
CVE-2026-66858
Apache Thrift, Apache Thrift, Apache Thrift, Apache Thrift,
V. Comments for CVE-2026-103008
No comments yet