Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-10-06T19:31:40 elasticsearch: Elasticsearch: Denial of Service via uncontrolled recursion 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-770

Uncontrolled Recursion (CWE-674) in Elasticsearch can allow an authenticated user with low privileges to terminate an Elasticsearch node, resulting in denial of service, via Excessive Allocation (CAPEC-130).

A flaw was found in Elasticsearch. An authenticated user with low privileges can cause a Denial of Service (DoS) by triggering excessive resource allocation through uncontrolled recursive operations. This issue causes the affected Elasticsearch node to terminate unexpectedly, disrupting service availability.

Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-feature-server-rhel9 Red Hat Quay 3 Not affected quay/quay-rhel8 Red Hat Quay 3 Not affected quay/quay-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-102409 https://nvd.nist.gov/vuln/detail/CVE-2026-102409 https://discuss.elastic.co/t/elasticsearch-9-4-8-9-5-5-security-update-esa-2026-190/390863