CVE-2026-103008: Elasticsearch Uncontrolled Recursion DoS Vulnerability

CVE-2026-103008 Overview

CVE-2026-103008 is an uncontrolled recursion weakness [CWE-674] in Elasticsearch that enables an authenticated user to crash a cluster node. The flaw resides in how Elasticsearch builds and serializes geometry values produced by scripted runtime fields. Geometry supplied as text is subject to a nesting-depth limit, but geometry constructed from a script's output has no such bound. An authenticated user with read access to a single index can submit a crafted request that forces the server to process a deeply nested data structure. Processing exhausts the available stack space and terminates the affected node. The node does not recover automatically on all deployments and may require manual intervention.

Critical Impact
An authenticated low-privilege user can terminate Elasticsearch nodes and cause service disruption that may require manual recovery.

Affected Products

Elasticsearch 8.19 (fixed in 8.19.23)
Elasticsearch 9.4 (fixed in 9.4.8)
Elasticsearch 9.5 (fixed in 9.5.5)

Discovery Timeline

2026-10-06 - CVE-2026-103008 published to the National Vulnerability Database
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-103008

Vulnerability Analysis

Elasticsearch supports runtime fields defined by user-supplied scripts. For geometry-typed runtime fields, the script returns geometry values that Elasticsearch then builds and serializes server-side. The construction and serialization paths for script-produced geometry do not enforce a maximum nesting depth. This differs from text-based geometry parsing, which rejects structures beyond a configured depth limit. Because the recursion traversal mirrors the input structure, an adversary who controls the script output controls the recursion depth. Once the recursive call chain exceeds the JVM thread's stack, the thread raises a StackOverflowError and the node terminates. Operators report that affected nodes do not always restart cleanly, requiring intervention to restore cluster health.

Root Cause

The root cause is missing input-depth validation on geometry values emitted by scripted runtime fields. The text-geometry parser enforces a depth bound, but the equivalent protection was never applied to the script-output code path. This represents an inconsistent application of a defensive control across input sources.

Attack Vector

Exploitation requires network access to the Elasticsearch HTTP or transport API and authenticated credentials with read access to at least one index. The attacker submits a search or runtime-field definition request that references a geometry runtime field whose script generates a deeply nested geometry structure (for example, nested GeometryCollection objects). Processing the response construction recurses past the JVM stack limit and crashes the executing node. No user interaction is required and no confidentiality or integrity impact occurs; the impact is restricted to availability.

The vulnerability mechanism is described in prose only. See the Elastic Security Update ESA-2026-198 for vendor technical details.

Detection Methods for CVE-2026-103008

Indicators of Compromise

StackOverflowError entries in Elasticsearch node logs correlated with search or _search requests that reference runtime fields of geometry type.
Abrupt node termination events without preceding resource saturation (CPU or heap exhaustion).
Cluster state transitions showing nodes leaving and failing to rejoin without operator action.

Detection Strategies

Audit Elasticsearch request logs for runtime field definitions of type geo_shape or geo_point that include user-supplied Painless scripts.
Correlate authenticated user activity with node crash timestamps to identify the originating account.
Monitor the Elasticsearch _nodes/stats API for unexpected JVM thread terminations.

Monitoring Recommendations

Alert on repeated node restarts or cluster red or yellow state transitions following search traffic from a single principal.
Enable Elasticsearch audit logging and forward events to a SIEM for query-level inspection of runtime field submissions.
Track the frequency of script-based runtime field requests per user and flag anomalous spikes.

How to Mitigate CVE-2026-103008

Immediate Actions Required

Upgrade Elasticsearch to version 8.19.23, 9.4.8, or 9.5.5 or later as appropriate for your deployment.
Review which authenticated principals hold read access to indices and remove unnecessary grants.
Restrict the ability to define scripted runtime fields to trusted administrative roles.

Patch Information

Elastic has released fixed builds in Elasticsearch 8.19.23, 9.4.8, and 9.5.5. Refer to the Elastic Security Update ESA-2026-198 for the complete advisory and upgrade guidance.

Workarounds

Disable scripted runtime fields where they are not required by setting role-based restrictions that prevent runtime mappings in search requests.
Apply the script.allowed_types cluster setting to limit script usage to vetted contexts.
Place an API gateway or reverse proxy in front of Elasticsearch to inspect and reject requests containing suspicious runtime field definitions until patching completes.

bash

# Example: restrict script types cluster-wide via elasticsearch.yml
script.allowed_types: inline
script.allowed_contexts: search, update