CVE-2026-102409
published 2026-10-06CVE-2026-102409: Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial…
PriorityP432medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.30%
21.1th percentile
Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130).
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | 9.2.0 – 9.2.8 | — |
| elastic | elasticsearch | 9.3.0 – 9.3.8 | — |
| elastic | elasticsearch | 9.4.0 – 9.4.7 | — |
| elastic | elasticsearch | 9.5.0 – 9.5.4 | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPE
ghsa_unreviewed·2026-10-06
CVE-2026-102409 [MEDIUM] CWE-674 Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPE
Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130).
Red Hat
elasticsearch: Elasticsearch: Denial of Service via uncontrolled recursion
vendor_redhat·2026-10-06·CVSS 6.5
CVE-2026-102409 [MEDIUM] CWE-770 elasticsearch: Elasticsearch: Denial of Service via uncontrolled recursion
elasticsearch: Elasticsearch: Denial of Service via uncontrolled recursion
Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130).
A flaw was found in Elasticsearch. An authenticated user with low privileges can cause a Denial of Service (DoS) by triggering excessive resource allocation through uncontrolled recursive operations. This issue causes the affected Elasticsearch node to terminate unexpectedly, disrupting service availability.
Package: rhoai/odh-feature-server-rhel9 (Red Hat OpenShift AI (RHOAI)) - Fix deferred
Package: quay/quay-rhel8 (Red Hat Quay 3) - Not affected
Package: quay/quay-rhel9 (Red Hat Quay 3) - Not affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-102409 python-elasticsearch: Elasticsearch: Denial of Service via uncontrolled recursion [epel-all]
bugzilla·2026-10-08·CVSS 6.5
CVE-2026-102409 [MEDIUM] CVE-2026-102409 python-elasticsearch: Elasticsearch: Denial of Service via uncontrolled recursion [epel-all]
CVE-2026-102409 python-elasticsearch: Elasticsearch: Denial of Service via uncontrolled recursion [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130).
Bugzilla
CVE-2026-102409 python-elasticsearch: Elasticsearch: Denial of Service via uncontrolled recursion [fedora-all]
bugzilla·2026-10-08·CVSS 6.5
CVE-2026-102409 [MEDIUM] CVE-2026-102409 python-elasticsearch: Elasticsearch: Denial of Service via uncontrolled recursion [fedora-all]
CVE-2026-102409 python-elasticsearch: Elasticsearch: Denial of Service via uncontrolled recursion [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130).
Bugzilla
CVE-2026-102409 python-elasticsearch6: Elasticsearch: Denial of Service via uncontrolled recursion [epel-all]
bugzilla·2026-10-08·CVSS 6.5
CVE-2026-102409 [MEDIUM] CVE-2026-102409 python-elasticsearch6: Elasticsearch: Denial of Service via uncontrolled recursion [epel-all]
CVE-2026-102409 python-elasticsearch6: Elasticsearch: Denial of Service via uncontrolled recursion [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130).
Bugzilla
CVE-2026-102409 elasticsearch: Elasticsearch: Denial of Service via uncontrolled recursion
bugzilla·2026-10-06·CVSS 6.5
CVE-2026-102409 [MEDIUM] CVE-2026-102409 elasticsearch: Elasticsearch: Denial of Service via uncontrolled recursion
CVE-2026-102409 elasticsearch: Elasticsearch: Denial of Service via uncontrolled recursion
Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130).
2026-10-06
Published