CVE-2026-115290: Unauthenticated DoS in Elasticsearch

Elasticsearch vulnerable to DoS via uncontrolled recursion. Unauthenticated attack, public PoC, CVSS 7.5.

CVE-2026-115290 involves an Uncontrolled Recursion vulnerability (CWE-674) in Elasticsearch. An unauthenticated attacker can send a specially crafted request to the remote cluster server interface of a node, causing unlimited recursion through nested serialized payloads (CAPEC-230). The result is node termination and denial of service. No credentials are required: anyone with network access to nodes can repeat the attack against every reachable instance.

The CVSS score is 7.5 (HIGH). The vulnerability was published on NVD on November 3, 2026. Critically, by November 5 public proofs of concept were published on GitHub demonstrating the behavior on Elasticsearch 8.19.23 versus 8.19.24. This indicates active validation, requires immediate verification, and leaves limited time for patching.

Immediate action: verify your Elasticsearch version via cluster API. If running 8.19.23 or earlier vulnerable versions, apply the security patch from Elastic (ESA-2026-201). If patching is not immediately possible, restrict network access to the remote cluster interface via firewall or VPC, limiting exposure to authorized nodes only. Monitor Elasticsearch logs for suspicious remote cluster connection attempts.

At a glance

What: Uncontrolled Recursion (CWE-674) in Elasticsearch via nested serialized payloads (CAPEC-230). Unauthenticated attacker can terminate a node by sending crafted request to remote cluster interface.
Severity: CVSS 7.5 - HIGH. DoS attack with high operational impact, no credentials required, affects every reachable node.
Affected versions: Not explicitly listed in official NVD description. PoC shows differing behavior between 8.19.23 and 8.19.24; verify via cluster API.
Fix: Apply official Elastic security patch (ESA-2026-201). Update Elasticsearch to corrected version available from Elastic.
Status: Published NVD November 3, 2026. Public proofs of concept on GitHub as of November 5, 2026. Not confirmed as actively exploited in the wild.
Action: Verify installed version via cluster API. Apply patch or restrict remote cluster interface access via firewall/VPC. Monitor logs for anomalous connection attempts.

Sources: NVD, CVE-2026-115290

← All articles