Medium severity6.5NVD Advisory· Published Jul 21, 2026· Updated Aug 3, 2026

CVE-2026-63144

Description

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that terminates the affected node. In single-node deployments, this results in complete service outage; in multi-node clusters, it causes repeated node restarts and sustained availability degradation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Elastic/Elasticsearch2 versions
cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*range: >=8.19.0,<8.19.19
- (no CPE)
osv-coords9 versions
pkg:apk/chainguard/ruby3.2-elasticsearch pkg:apk/chainguard/ruby3.3-elasticsearch pkg:apk/wolfi/ruby4.0-elasticsearch pkg:apk/chainguard/ruby3.4-elasticsearch pkg:apk/chainguard/ruby4.0-elasticsearch pkg:apk/wolfi/ruby3.3-elasticsearch pkg:apk/wolfi/ruby3.4-elasticsearch pkg:bitnami/elasticsearch pkg:apk/wolfi/ruby3.2-elasticsearch
< 9.5.0-r0+ 8 more
- (no CPE)range: < 9.5.0-r0
- (no CPE)range: < 9.5.0-r0
- (no CPE)range: < 9.5.0-r0
- (no CPE)range: < 9.5.0-r1
- (no CPE)range: < 9.5.0-r0
- (no CPE)range: < 9.5.0-r0
- (no CPE)range: < 9.5.0-r1
- (no CPE)range: >= 8.0.0, < 8.19.19
- (no CPE)range: < 9.5.0-r0
Fantastic ElasticSearch/Fantastic ElasticSearchllm-fuzzy

Patches

Vulnerability mechanics

References

discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-68/388571nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000