Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-10-06T19:31:39 elasticsearch: elasticsearch: Denial of Service via crafted regular expressions in ES|QL CHUNK function 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CWE-1333

Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers catastrophic backtracking, consuming excessive CPU on Elasticsearch worker threads and degrading query throughput for other tenants on the affected node. The cluster does not crash as a result of this issue.

A flaw was found in Elasticsearch. An authenticated attacker with read access to an index can cause a Denial of Service (DoS) by submitting queries containing specially crafted regular expressions to the ES|QL CHUNK function. Because the component does not properly restrict regular expression complexity or limit processing time, evaluating the pattern triggers excessive CPU consumption, significantly degrading query performance on the affected node.

This vulnerability is rated as having Moderate impact because exploitation requires authenticated callers possessing index query permissions and causes performance degradation rather than process termination or data compromise. Within supported deployments utilizing affected Elasticsearch engines, processing malicious text-splitting expressions can exhaust node worker threads through computational backtracking. Although node services do not crash and data integrity remains unaffected, overall search throughput across multi-tenant clusters can be diminished. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-feature-server-rhel9 Red Hat Quay 3 Not affected quay/quay-rhel8 Red Hat Quay 3 Not affected quay/quay-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-102408 https://nvd.nist.gov/vuln/detail/CVE-2026-102408 https://discuss.elastic.co/t/elasticsearch-8-19-22-9-4-8-and-9-5-5-security-update-esa-2026-189/390862