CVE-2026-103006: Elasticsearch Aggregation DOS Vulnerability

CVE-2026-103006 Overview

CVE-2026-103006 is an uncontrolled recursion weakness [CWE-674] in the Elasticsearch search aggregation feature. An authenticated user with read access to a single index can submit a specially crafted request containing deeply nested aggregation definitions. Processing this request triggers unbounded recursive execution that exhausts the server process's available resources. The affected node terminates and does not recover automatically, requiring manual intervention to restore service. Elastic published the fix in security update ESA-2026-196, covering Elasticsearch versions 8.19.21, 9.4.6, and 9.5.2.

Critical Impact
A low-privileged authenticated user holding read access to any single index can crash an Elasticsearch node, disrupting search availability until operators manually restart the service.

Affected Products

Elasticsearch versions prior to 8.19.21
Elasticsearch 9.x versions prior to 9.4.6
Elasticsearch 9.5.x versions prior to 9.5.2

Discovery Timeline

2026-10-06 - CVE-2026-103006 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-103006

Vulnerability Analysis

The vulnerability resides in the aggregation processing logic of the Elasticsearch search API. Aggregations in Elasticsearch allow clients to group and summarize data, and the engine supports nesting one aggregation inside another to build hierarchical analytics. The server parses and evaluates each nested level recursively.

The aggregation processor does not enforce a depth limit on nested aggregation definitions. When a client submits a request with excessive nesting, the server recurses until it exhausts the thread stack or available heap memory. The exhaustion causes the Java Virtual Machine process backing the Elasticsearch node to terminate.

Because the crash occurs at the process level and the node does not restart on its own, service availability depends on operator intervention. The impact targets availability only; the flaw does not expose data or allow modification.

Root Cause

The root cause is missing input validation on the depth of nested aggregation structures accepted by the search API. The aggregation parser processes recursive structures without bounding the recursion depth or imposing a complexity ceiling, which maps directly to [CWE-674 Uncontrolled Recursion].

Attack Vector

Exploitation requires network access to the Elasticsearch REST API and valid authentication credentials with read permission on at least one index. The attacker crafts a search request to the _search endpoint containing an aggregation body with deeply nested sub-aggregations. Submitting the request forces the node to recurse through each level, exhausting resources and terminating the node process.

The vulnerability does not require administrative privileges or user interaction. In clusters where read permissions are broadly granted to applications or service accounts, the attack surface is correspondingly wide.

No verified public exploit code is available. See the Elastic Security Update ESA-2026-196 for vendor-provided technical details.

Detection Methods for CVE-2026-103006

Indicators of Compromise

Unexpected termination of Elasticsearch node processes without an orderly shutdown entry in the cluster logs.
Search API requests to _search endpoints containing aggregation JSON bodies with abnormal nesting depth.
Spikes in JVM heap usage or stack-related errors in Elasticsearch logs immediately preceding a node crash.

Detection Strategies

Inspect proxy and application gateway logs for POST requests to Elasticsearch _search paths with payload sizes or nesting counts beyond expected baselines.
Parse captured aggregation request bodies for repeated aggs or aggregations keys exceeding a reasonable depth threshold.
Correlate authenticated API client identities with node restart events to identify the source of malicious requests.

Monitoring Recommendations

Alert on repeated Elasticsearch node crashes or JVM exits within short time windows across a cluster.
Track per-user and per-API-key request rates to _search endpoints and flag outliers.
Forward Elasticsearch audit logs to a centralized analytics platform to retain evidence of the originating request after a node restart.

How to Mitigate CVE-2026-103006

Immediate Actions Required

Upgrade Elasticsearch to version 8.19.21, 9.4.6, or 9.5.2 or later as released in ESA-2026-196.
Review index-level read permissions and revoke access from accounts that do not require search capability.
Enable Elasticsearch audit logging to capture the identity and payload of requests that precede node crashes.

Patch Information

Elastic addressed the issue in security update ESA-2026-196, delivered in Elasticsearch 8.19.21, 9.4.6, and 9.5.2. Operators should apply the upgrade through standard rolling upgrade procedures. See the Elastic Security Update ESA-2026-196 advisory for version-specific guidance.

Workarounds

Place a reverse proxy or API gateway in front of Elasticsearch and reject _search request bodies that exceed a defined size or nesting depth.
Restrict API key and role permissions so untrusted or low-trust service accounts cannot invoke the search API.
Configure process supervision (for example, systemd with Restart=on-failure) to automatically restart terminated Elasticsearch nodes while patches are being deployed.

bash

# Example systemd override to auto-restart terminated Elasticsearch nodes
# /etc/systemd/system/elasticsearch.service.d/override.conf
[Service]
Restart=on-failure
RestartSec=10s