CVE-2026-115290

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-115290", "assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "state": "PUBLISHED", "assignerShortName": "elastic", "dateReserved": "2026-10-22T09:42:41.198Z", "datePublished": "2026-11-03T16:43:59.960Z", "dateUpdated": "2026-11-03T17:36:07.924Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Elasticsearch", "vendor": "Elastic", "versions": [{"status": "affected", "versionType": "semver", "version": "8.10.0", "lessThanOrEqual": "8.19.23"}, {"status": "affected", "versionType": "semver", "version": "9.0.0", "lessThanOrEqual": "9.4.8"}, {"status": "affected", "versionType": "semver", "version": "9.5.0", "lessThanOrEqual": "9.5.5"}]}], "descriptions": [{"lang": "en", "value": "Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.</p>"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "shortName": "elastic", "dateUpdated": "2026-11-03T16:43:59.960Z"}, "references": [{"url": "https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356"}], "source": {"discovery": "Elastic"}, "title": "Uncontrolled Recursion in Elasticsearch Leading to Denial of Service", "x_generator": {"engine": "Elastic CVE Publisher 1.0.0"}, "impacts": [{"capecId": "CAPEC-230", "descriptions": [{"lang": "en", "value": "CAPEC-230 Serialized Data with Nested Payloads"}]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T17:35:42.569226Z", "id": "CVE-2026-115290", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T17:36:07.924Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-115290", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-03T17:35:42.569226Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T17:35:55.603Z"}}], "cna": {"title": "Uncontrolled Recursion in Elasticsearch Leading to Denial of Service", "source": {"discovery": "Elastic"}, "impacts": [{"capecId": "CAPEC-230", "descriptions": [{"lang": "en", "value": "CAPEC-230 Serialized Data with Nested Payloads"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Elastic", "product": "Elasticsearch", "versions": [{"status": "affected", "version": "8.10.0", "versionType": "semver", "lessThanOrEqual": "8.19.23"}, {"status": "affected", "version": "9.0.0", "versionType": "semver", "lessThanOrEqual": "9.4.8"}, {"status": "affected", "version": "9.5.0", "versionType": "semver", "lessThanOrEqual": "9.5.5"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356"}], "x_generator": {"engine": "Elastic CVE Publisher 1.0.0"}, "descriptions": [{"lang": "en", "value": "Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.", "supportingMedia": [{"type": "text/html", "value": "<p>Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion"}]}], "providerMetadata": {"orgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "shortName": "elastic", "dateUpdated": "2026-11-03T16:43:59.960Z"}}}, "cveMetadata": {"cveId": "CVE-2026-115290", "state": "PUBLISHED", "dateUpdated": "2026-11-03T17:36:07.924Z", "dateReserved": "2026-10-22T09:42:41.198Z", "assignerOrgId": "271b6943-45a9-4f3a-ab4e-976f3fa05b5a", "datePublished": "2026-11-03T16:43:59.960Z", "assignerShortName": "elastic"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Elasticsearch", "vendor": "Elastic", "versions": [{"lessThanOrEqual": "8.19.23", "status": "affected", "version": "8.10.0", "versionType": "semver"}, {"lessThanOrEqual": "9.4.8", "status": "affected", "version": "9.0.0", "versionType": "semver"}, {"lessThanOrEqual": "9.5.5", "status": "affected", "version": "9.5.0", "versionType": "semver"}]}], "source": "security@elastic.co"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node."}], "id": "CVE-2026-115290", "lastModified": "2026-11-03T20:32:50.687", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security@elastic.co", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-115290", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T17:35:42.569226Z", "version": "2.0.3"}}]}, "published": "2026-11-03T17:17:54.943", "references": [{"source": "security@elastic.co", "url": "https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356"}], "sourceIdentifier": "security@elastic.co", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "security@elastic.co", "type": "Secondary"}]}

{"bugzilla": {"description": "elasticsearch: elasticsearch: Denial of Service via deeply nested serialized payloads", "id": "2566132", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2566132"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-502", "details": ["Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.", "A flaw was found in Elasticsearch. An unauthenticated remote attacker with network access to a node's remote cluster server interface can send specially crafted requests containing deeply nested serialized data. Processing this data triggers excessive recursion, causing the affected node to crash and leading to a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "--- CME Mitigation Guidance (2026-11-04) ---\nDisclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.\nThe highest-value action is to enforce recursion depth limits and reject deeply nested serialized payloads received over the remote cluster server interface: upgrade to Elasticsearch 8.19.24, 9.4.9, or 9.5.6 (or the fixed Python Elasticsearch builds), which restrict recursion depth and reject deeply nested serialized payloads received over the remote cluster server interface, closing deeply nested serialized payloads. Until patched, this is a concern on Elasticsearch nodes with the remote cluster server interface enabled, so disable the remote cluster server interface or restrict network access to the interface using IP filtering. These controls limit blast radius and contain exploitation, but they do not fix the underlying uncontrolled recursion defect \u2014 apply the upstream patch to fully remediate.\nHighest-impact CME: CME-1316 Algorithmic Complexity Safeguards (Pattern/Regex Execution Limits) (high)"}, "name": "CVE-2026-115290", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-feature-server-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Not affected", "package_name": "quay/quay-rhel8", "product_name": "Red Hat Quay 3"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Not affected", "package_name": "quay/quay-rhel9", "product_name": "Red Hat Quay 3"}], "public_date": "2026-11-03T16:43:59Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-115290\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-115290\nhttps://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356"], "statement": "This vulnerability is rated as Important severity because an unauthenticated remote attacker can crash cluster nodes without requiring credentials, resulting in a denial of service across search and indexing workloads. In Red Hat environments, Elasticsearch deployments are typically isolated within internal network segments or container platforms without direct public exposure. However, any actor with network visibility to the cluster interface can cause consecutive node failures, justifying the Important rating due to high availability impact.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[8.10.0,8.19.23]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.0.0,9.4.8]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.5.0,9.5.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Elasticsearch", "source": "cna", "vendor": "Elastic"}, "product": "elasticsearch", "vendor": "elastic"}], "created": "2026-11-03T18:45:14.392751+00:00", "updated": "2026-11-07T02:00:08.815800+00:00", "vendors": ["elastic", "elastic$PRODUCT$elasticsearch"]}