CyberRota Analysis
AI-GeneratedElasticsearch is vulnerable to an uncontrolled recursion issue that can be exploited by authenticated users with read-only access to a single index. By submitting a specially crafted search request with deeply nested payloads, an attacker can cause a denial of service by exhausting the thread stack and crashing the affected node. Organizations using Elasticsearch should prioritize this vulnerability to prevent potential service disruptions.
Original NVD Description
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without a depth limit, exhausting the thread stack and terminating the affected node.
Related CVEs
Other vulnerabilities affecting the same vendor(s)