CVE-2026-102408
published 2026-10-06CVE-2026-102408: Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The…
PriorityP424medium4.3CVSS 3.1
AVNACLPRLUINSUCNINAL
EPSS
0.34%
25.4th percentile
Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers catastrophic backtracking, consuming excessive CPU on Elasticsearch worker threads and degrading query throughput for other tenants on the affected node. The cluster does not crash as a result of this issue.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | 8.19.0 – 8.19.21 | — |
| elastic | elasticsearch | 9.1.0 – 9.3.8 | — |
| elastic | elasticsearch | 9.4.0 – 9.4.7 | — |
| elastic | elasticsearch | 9.5.0 – 9.5.4 | — |
| rhoai | odh-feature-server-rhel9 | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
elasticsearch: elasticsearch: Denial of Service via crafted regular expressions in ES|QL CHUNK function
vendor_redhat·2026-10-06·CVSS 4.3
CVE-2026-102408 [MEDIUM] CWE-1333 elasticsearch: elasticsearch: Denial of Service via crafted regular expressions in ES|QL CHUNK function
elasticsearch: elasticsearch: Denial of Service via crafted regular expressions in ES|QL CHUNK function
Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers catastrophic backtracking, consuming excessive CPU on Elasticsearch worker threads and degrading query throughput for other tenants on the affected node. The cluster does not crash as a r
GHSA
Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492).
ghsa_unreviewed·2026-10-06
CVE-2026-102408 [MEDIUM] CWE-1333 Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492).
Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers catastrophic backtracking, consuming excessive CPU on Elasticsearch worker threads and degrading query throughput for other tenants on the affected node. The cluster does not crash as a result of this issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-102408 python-elasticsearch: elasticsearch: Denial of Service via crafted regular expressions in ES|QL CHUNK function [fedora-all]
bugzilla·2026-10-08·CVSS 4.3
CVE-2026-102408 [MEDIUM] CVE-2026-102408 python-elasticsearch: elasticsearch: Denial of Service via crafted regular expressions in ES|QL CHUNK function [fedora-all]
CVE-2026-102408 python-elasticsearch: elasticsearch: Denial of Service via crafted regular expressions in ES|QL CHUNK function [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-ba
Bugzilla
CVE-2026-102408 python-elasticsearch6: elasticsearch: Denial of Service via crafted regular expressions in ES|QL CHUNK function [epel-all]
bugzilla·2026-10-08·CVSS 4.3
CVE-2026-102408 [MEDIUM] CVE-2026-102408 python-elasticsearch6: elasticsearch: Denial of Service via crafted regular expressions in ES|QL CHUNK function [epel-all]
CVE-2026-102408 python-elasticsearch6: elasticsearch: Denial of Service via crafted regular expressions in ES|QL CHUNK function [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-bas
Bugzilla
CVE-2026-102408 python-elasticsearch: elasticsearch: Denial of Service via crafted regular expressions in ES|QL CHUNK function [epel-all]
bugzilla·2026-10-08·CVSS 4.3
CVE-2026-102408 [MEDIUM] CVE-2026-102408 python-elasticsearch: elasticsearch: Denial of Service via crafted regular expressions in ES|QL CHUNK function [epel-all]
CVE-2026-102408 python-elasticsearch: elasticsearch: Denial of Service via crafted regular expressions in ES|QL CHUNK function [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-base
Bugzilla
CVE-2026-102408 elasticsearch: elasticsearch: Denial of Service via crafted regular expressions in ES|QL CHUNK function
bugzilla·2026-10-06·CVSS 4.3
CVE-2026-102408 [MEDIUM] CVE-2026-102408 elasticsearch: elasticsearch: Denial of Service via crafted regular expressions in ES|QL CHUNK function
CVE-2026-102408 elasticsearch: elasticsearch: Denial of Service via crafted regular expressions in ES|QL CHUNK function
Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers catastrophic backtracking, consuming excessive CPU on Elasticsearch worker threads and degrading query throughput for other tenants on the affected node. The cluster does
2026-10-06
Published