UpHeron
All vulnerabilities

Servers and applications

CVE-2026-103006

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted, deeply nested request submitted to the aggregation feature of the search API. Elasticsearch contains an uncontrolled recursion weakness in its search aggregation processing. An authenticated user with read access to a single index can submit a specially crafted request containing deeply…

Severity
Medium 6.5
Published
6 Oct 2026
Last changed
9 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
8.19.21, 9.4.6, 9.5.2
Sources
NVD

Affected software

SoftwareAffected versions
ElasticsearchServers and applications · cpe:a:elastic:elasticsearch
  • From 8.0.0 before 8.19.21
  • From 9.0.0 before 9.4.6
  • From 9.5.0 before 9.5.2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-103006
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-103006