CVE-2026-103006

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Published

Oct 6, 2026, 7:31:49 PM UTC

Updated

Oct 6, 2026, 8:17:13 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.41% · Oct 25, 2026

A flaw was found in Elasticsearch. An authenticated remote user with read access can trigger excessive recursion by submitting a specially crafted search request with deeply nested aggregations. Processing this request exhausts server resources and causes the affected node to crash, resulting in a Denial of Service (DoS) that requires manual intervention to restore service. elasticsearch: Elasticsearch: Denial of Service via deeply nested search aggregations This vulnerability is rated as Moderate severity because exploitation requires authenticated read permissions on an index, preventing unauthenticated external attackers from triggering the condition. While an authorized user can induce a node crash by submitting deeply structured aggregation queries that exhaust process call stack limits, the flaw does not permit unauthorized data disclosure or modification. In Red Hat environments, such as Red Hat OpenShift AI deployments, Elasticsearch access is typically confined to internal networks and authenticated workloads, which reduces overall exposure. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.