SB2026070208 - Multiple vulnerabilities in Elasticsearch

Description

This security bulletin contains information about 2 vulnerabilities.

1) Uncontrolled Recursion (CVE-ID: CVE-2026-56148)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in Elasticsearch when processing user-supplied queries. A remote user can submit a specially crafted query to cause a denial of service.

The issue may cause excessive resource consumption and render the affected node unavailable.

2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-56149)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the machine learning request handling functionality when processing a specially crafted machine learning request. A remote privileged user can submit a specially crafted machine learning request to cause a denial of service.

Only deployments that use machine learning are vulnerable. Exploitation requires privileges to create or manage trained models.

Remediation

Install update from vendor's website.

References

• https://discuss.elastic.co/t/elasticsearch-8-19-17-9-3-6-9-4-3-security-update-esa-2026-42/387439
• https://discuss.elastic.co/t/elasticsearch-8-19-17-9-3-6-9-4-3-security-update-esa-2026-43/387440