CVE-2026-102408: Elasticsearch ES|QL CHUNK DOS Vulnerability

CVE-2026-102408 Overview

CVE-2026-102408 is an inefficient regular expression complexity vulnerability [CWE-1333] in Elasticsearch. The flaw resides in the ES|QL CHUNK function's recursive chunking strategy, which accepts user-supplied regular expressions as text-splitting separators without validating their computational complexity. An authenticated user with read access to any text-based index can submit a crafted regular expression that triggers catastrophic backtracking. The resulting CPU exhaustion on Elasticsearch worker threads degrades query throughput for other tenants on the affected node. The cluster itself does not crash. Elastic published the fix in Security Update ESA-2026-189.

Critical Impact

Authenticated users can degrade Elasticsearch query throughput across tenants by submitting pathological regular expressions to the ES|QL CHUNK function.

Affected Products

• Elasticsearch 8.x prior to 8.19.22
• Elasticsearch 9.4.x prior to 9.4.8
• Elasticsearch 9.5.x prior to 9.5.5

Discovery Timeline

• 2026-10-06 - CVE-2026-102408 published to NVD
• 2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-102408

Vulnerability Analysis

The vulnerability is a Regular Expression Denial of Service (ReDoS) condition, classified under the Regular Expression Exponential Blowup pattern (CAPEC-492). The ES|QL CHUNK function splits input text using separators that callers provide as regular expressions. The function evaluates these patterns on Elasticsearch worker threads without bounding execution time or restricting pattern complexity. When a user submits a pattern with nested quantifiers or ambiguous alternation, the regex engine performs catastrophic backtracking against adversarial inputs. CPU on the handling node spikes, and other queries scheduled on the same worker pool experience increased latency. The confidentiality and integrity of indexed data are not affected.

Root Cause

The recursive chunking strategy inside the CHUNK function trusts caller-supplied separator patterns. The implementation performs no pre-compilation safety checks, no complexity analysis, and no per-pattern execution timeout. Any authenticated principal with read access to a text-based index can supply a pattern that forces exponential state exploration in the regex engine.

Attack Vector

Exploitation requires network access to the Elasticsearch REST API and authenticated credentials with read access to at least one text index. The attacker issues an ES|QL query that invokes CHUNK with a crafted separator such as a pattern containing nested quantifiers over overlapping character classes. The pattern is applied to field values during query execution, pinning a worker thread until the regex engine exhausts backtracking states. Repeated submissions amplify the throughput impact on co-tenant workloads. See the Elastic Security Update ESA-2026-189 for vendor technical details.

Detection Methods for CVE-2026-102408

Indicators of Compromise

• Sustained CPU saturation on Elasticsearch worker threads without a corresponding increase in query volume.
• ES|QL query audit logs containing calls to the CHUNK function with unusually complex separator expressions.
• Increased query latency and timeouts for unrelated tenants on the same node.

Detection Strategies

• Enable Elasticsearch audit logging and inspect ES|QL request bodies for CHUNK invocations containing nested quantifiers or alternations.
• Correlate per-user query submissions with node-level CPU metrics to identify principals whose queries disproportionately consume compute.
• Alert on long-running ES|QL queries that exceed baseline execution time for text-processing operations.

Monitoring Recommendations

• Track thread_pool.search.active and worker thread CPU time per node and alert on sustained saturation.
• Baseline ES|QL query latency and generate alerts when the 95th percentile deviates significantly.
• Forward Elasticsearch audit and slow logs to a centralized SIEM for pattern analysis of regex-heavy queries.

How to Mitigate CVE-2026-102408

Immediate Actions Required

• Upgrade Elasticsearch to version 8.19.22, 9.4.8, or 9.5.5 as applicable to your deployment track.
• Audit role mappings and remove read access from accounts that do not require ES|QL query capability.
• Review recent ES|QL audit logs for anomalous CHUNK usage prior to patching.

Patch Information

Elastic released fixed versions in Security Update ESA-2026-189: Elasticsearch 8.19.22, 9.4.8, and 9.5.5. Operators running clusters on any earlier release in these branches should plan a rolling upgrade. Refer to the Elastic Security Update ESA-2026-189 advisory for the full patch notes and upgrade guidance.

Workarounds

• Restrict ES|QL query privileges to trusted service accounts until the cluster is patched.
• Place a reverse proxy or API gateway in front of Elasticsearch and reject requests whose bodies contain CHUNK with high-complexity separators.
• Configure per-user search request quotas and query timeouts to limit the blast radius of long-running regex evaluations.

# Example: restrict ES|QL access via a role definition
PUT _security/role/esql_restricted
{
  "cluster": ["monitor"],
  "indices": [
    {
      "names": ["logs-*"],
      "privileges": ["read"],
      "query": "{\"match_all\": {}}"
    }
  ]
}