UpHeron
All vulnerabilities

Servers and applications

CVE-2026-103008

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial of Service via a specially crafted request that causes the server to construct and process a deeply nested data structure with no bound on recursion depth. Elasticsearch contains an uncontrolled recursion weakness in how it builds and serializes geometry values produced by scripted runtime fields. Unlike geometry supplied as…

Severity
Medium 6.5
Published
6 Oct 2026
Last changed
9 Oct 2026
Added to UpHeron
21 Oct 2026
Fixed in
8.19.23, 9.4.8, 9.5.5
Sources
NVD

Affected software

SoftwareAffected versions
ElasticsearchServers and applications · cpe:a:elastic:elasticsearch
  • From 8.12.0 before 8.19.23
  • From 9.0.0 before 9.4.8
  • From 9.5.0 before 9.5.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-103008
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-103008