CVE catalog

CVE-2026-56148

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excessive

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.47% · Oct 25, 2026

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query that causes excessive resource consumption while the request is processed, which may render the affected node unavailable.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
CpeelasticsearchNot reported8.19.17fixed
CpeelasticsearchNot reported9.3.6fixed
CpeelasticsearchNot reported9.4.3fixed
Ubuntuelasticsearch16.041.6.2+dfsg-1vulnerable
Ubuntuelasticsearch16.041.7.3+dfsg-1vulnerable
Ubuntuelasticsearch16.041.7.3+dfsg-2vulnerable
Ubuntuelasticsearch16.041.7.3+dfsg-3vulnerable
CpeelasticsearchNot reported9.4.3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
CpeelasticsearchcpeNot reported8.19.17Not reportedNot reportedNot reported
CpeelasticsearchcpeNot reported9.3.6Not reportedNot reportedNot reported
CpeelasticsearchcpeNot reported9.4.3Not reportedNot reportedNot reported
CpeelasticsearchcpeNot reported9.4.3Not reportedNVD-CVE-2026-56148Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]