7.5Yüksek

CVE-2026-115290Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Elastic Elasticsearch Yayım: 2026-11-03 19:43 (8 gün önce)

Açıklama

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.

Zayıflık türü (CWE): CWE-674

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
Elastic	Elasticsearch	8.10.0 – ≤ 8.19.23, 9.0.0 – ≤ 9.4.8, 9.5.0 – ≤ 9.5.5

Kaynaklar ve yamalar

https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356

CVSS puanı

7.5Yüksek

Kaynak: elastic · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Yok
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Yok
Bütünlük: Yok
Erişilebilirlik: Yüksek

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Tüm puanlar (2)

cna	CVSS 3.1	7.5Yüksek
security@elastic.co	CVSS 3.1	7.5Yüksek

EPSS (30 günde istismar olasılığı)

0.41%

tüm CVE'lerin %36'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: yes
Teknik etki: partial

Zaman çizelgesi

Numara ayrıldı2026-10-22
Yayımlandı2026-11-03 19:43
IP-DB'ye ulaştı2026-11-03 20:03
Son güncelleme2026-11-03 23:32

Numarayı veren (CNA): elastic
NVD durumu: Awaiting Analysis

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — Elasticsearch

6.5Orta

CVE-2026-115715 8 gün önce

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service

Elastic Elasticsearch

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of the analysis-phonetic plugin. An authenticated user with per…

4.2Orta

CVE-2026-115710 8 gün önce

Use of Cache Containing Sensitive Information in Elasticsearch Leading to Information Disclosure

Elastic Elasticsearch

Use of Cache Containing Sensitive Information (CWE-524) in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query results between users wh…

4.3Orta

CVE-2026-115298 8 gün önce

Incorrect Authorization in Elasticsearch Leading to Information Disclosure

Elastic Elasticsearch

Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user whose index access is restricted by field-level security can retrieve the value…

7.1Yüksek

CVE-2026-103009 1 ay önce

Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure

Elastic Elasticsearch

Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypas…

6.5Orta

CVE-2026-103008 1 ay önce

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Elastic Elasticsearch

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontro…

7.2Yüksek

CVE-2026-103007 1 ay önce

Incorrect Authorization in Elasticsearch Leading to Privilege Escalation

Elastic Elasticsearch

Incorrect Authorization (CWE-863) in Elasticsearch can lead to Privilege Escalation via a delegated administrative privilege whose scope is not fully enforced during authorization checks. Elasticsearch contains an incorrect authorization weakness in a configu…