CVE-2026-63144: Elasticsearch DOS Vulnerability

CVE-2026-63144 Overview

CVE-2026-63144 is an uncontrolled recursion vulnerability [CWE-674] in Elasticsearch. A low-privileged authenticated user with read-level index access can submit a specially crafted search request that triggers unbounded recursive processing in the query evaluation component. The recursion produces a fatal error that terminates the affected node. Single-node deployments experience a complete service outage. Multi-node clusters experience repeated node restarts and sustained availability degradation. Elastic addressed the issue in security update ESA-2026-68, covering Elasticsearch versions 8.19.19, 9.3.8, and 9.4.4.

Critical Impact
An authenticated user with only read access can crash Elasticsearch nodes on demand, causing outages in single-node deployments and sustained availability degradation across clusters.

Affected Products

Elasticsearch 8.x prior to 8.19.19
Elasticsearch 9.3.x prior to 9.3.8
Elasticsearch 9.4.x prior to 9.4.4

Discovery Timeline

2026-07-21 - CVE-2026-63144 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63144

Vulnerability Analysis

The flaw resides in Elasticsearch's query evaluation component. When the component parses a search request, it recursively walks the query tree without enforcing a maximum recursion depth. A crafted query that nests structures deeply forces the Java Virtual Machine (JVM) to consume stack frames until it raises a fatal StackOverflowError. The error is not caught within the query pipeline, so the affected node terminates. In production clusters, the node restarts and rejoins, but a repeated request causes repeated crashes. The vulnerability affects availability only. Confidentiality and integrity are not impacted, as the fault occurs before results are returned.

Root Cause

The root cause is missing depth validation during recursive traversal of nested query constructs. The parser and evaluator delegate to themselves for each nested clause without tracking a depth counter or applying an upper bound. Because the recursion is data-driven, an attacker controls the depth through the request body.

Attack Vector

Exploitation is network-based and requires authentication with read-level index privileges. The attacker sends a single HTTP request to the Elasticsearch API containing a query with deeply nested clauses. No user interaction is required. The request terminates the receiving node. Repeated submissions to different coordinating nodes extend the impact across a cluster. Refer to the Elastic Security Update ESA-2026-68 for vendor technical details.

Detection Methods for CVE-2026-63144

Indicators of Compromise

Unexpected Elasticsearch node terminations accompanied by StackOverflowError entries in the node log or jvm.log files.
Cluster health transitions from green to yellow or red correlated with search requests from a single authenticated principal.
Repeated node restart events in orchestration platform logs (Kubernetes, systemd) without hardware or resource pressure indicators.

Detection Strategies

Parse Elasticsearch server logs for fatal JVM errors and correlate them with the source IP and API key of the preceding _search request.
Inspect audit logs to identify authenticated users submitting search bodies with abnormal nesting depth or payload size.
Alert on clusters where multiple data nodes crash within a short window after receiving requests from the same client.

Monitoring Recommendations

Enable Elasticsearch audit logging and ship access_granted events for indices:data/read/search actions to a central log platform.
Track the JVM StackOverflowError counter and node uptime metrics through the monitoring stack.
Baseline normal query depth and payload sizes, then alert on outliers exceeding the baseline.

How to Mitigate CVE-2026-63144

Immediate Actions Required

Upgrade Elasticsearch to 8.19.19, 9.3.8, or 9.4.4 as documented in ESA-2026-68.
Audit and reduce read-level index privileges granted to service accounts and application users.
Rotate API keys used by low-trust integrations after applying the patch.

Patch Information

Elastic released fixed versions 8.19.19, 9.3.8, and 9.4.4 under advisory ESA-2026-68. Details are available in the Elastic Security Update ESA-2026-68 announcement. Apply the upgrade to every node in the cluster and confirm the version through the GET / endpoint after the rolling restart.

Workarounds

Restrict search API access to trusted service accounts using role-based access control until patching is complete.
Place a reverse proxy or API gateway in front of Elasticsearch to enforce request body size limits and reject unusually deep JSON structures.
Isolate untrusted tenants on dedicated clusters so a crash from a malicious query does not degrade production workloads.

bash

# Configuration example: restrict read access and enforce request size limits at the proxy
# 1. Remove broad read grants from low-trust roles
curl -X POST "https://es.example.com:9200/_security/role/limited_reader" \
  -H "Content-Type: application/json" -u elastic \
  -d '{
    "indices": [
      { "names": ["public-*"], "privileges": ["read"] }
    ]
  }'

# 2. Enforce a maximum request body size at the ingress (nginx example)
# http { client_max_body_size 256k; }