CVE-2026-63144— Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1499 · Endpoint Denial of ServiceAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Elastic | Elasticsearch | 9.4.0≤ 9.4.3 | affected |
9.3.0≤ 9.3.7 | affected | ||
8.19.0≤ 8.19.18 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-63144
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Source: CVE Program / CVE List V5
Vulnerability Description
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that terminates the affected node. In single-node deployments, this results in complete service outage; in multi-node clusters, it causes repeated node restarts and sustained availability degradation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未经控制的递归
Source: CVE Program / CVE List V5
Vulnerability Title
Elastic Elasticsearch 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Elastic Elasticsearch是荷兰Elastic公司开源的一个搜索分析引擎。 Elastic Elasticsearch 9.4.0版本至9.4.3版本、9.3.0版本至9.3.7版本和8.19.0版本至8.19.18版本存在资源管理错误漏洞，该漏洞源于不受控制的递归，可能导致具有读取级别索引访问权限的低权限用户通过特制搜索请求触发无界递归处理，造成致命错误并终止受影响节点。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Elastic | Elasticsearch | 9.4.0 ~ 9.4.3 | - |
II. Public POCs for CVE-2026-63144
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-63144
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-63144 (1)
Same Patch Batch · Elastic · 2026-07-21 · 19 CVEs total
| CVE-2026-56147 | 7.1 HIGH | Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Informa |
| CVE-2026-42397 | 6.5 MEDIUM | Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Servic |
| CVE-2026-63263 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service |
| CVE-2026-63260 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service |
| CVE-2026-63261 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service |
| CVE-2026-63140 | 6.5 MEDIUM | Reachable Assertion in Elasticsearch Leading to Denial of Service |
| CVE-2026-63136 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service |
| CVE-2026-63139 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service |
| CVE-2026-56145 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service |
| CVE-2026-63141 | 6.3 MEDIUM | Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management |
| CVE-2026-56146 | 5.4 MEDIUM | Improper Access Control in Kibana Leading to Unauthorized Data Modification and Informatio |
| CVE-2026-56144 | 5.3 MEDIUM | Incorrect Authorization in Elasticsearch Leading to Information Disclosure |
| CVE-2026-63142 | 5.0 MEDIUM | Incomplete List of Disallowed Inputs in Kibana Leading to Server-Side Request Forgery |
| CVE-2026-63143 | 4.3 MEDIUM | Missing Authorization in Kibana Leading to Unauthorized Information Disclosure |
| CVE-2026-63259 | 4.3 MEDIUM | Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosu |
| CVE-2026-63145 | 4.3 MEDIUM | Incorrect Authorization in Kibana Leading to Machine Learning Audit Log Integrity Compromi |
| CVE-2026-63262 | 4.3 MEDIUM | Missing Authorization in Kibana Leading to Information Disclosure |
| CVE-2026-49092 | 4.3 MEDIUM | Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Unauthorized Inf |
IV. Related Vulnerabilities
Same product: Elasticsearch
- CVE-2026-63263
Uncontrolled Resource Consumption in Elasticsearch Leading t - CVE-2026-63140
Reachable Assertion in Elasticsearch Leading to Denial of Se - CVE-2026-63136
Uncontrolled Resource Consumption in Elasticsearch Leading t - CVE-2026-56145
Uncontrolled Resource Consumption in Elasticsearch Leading t - CVE-2026-56144
Incorrect Authorization in Elasticsearch Leading to Informat
Same vendor: Elastic
- CVE-2026-63263
Uncontrolled Resource Consumption in Elasticsearch Leading t - CVE-2026-63262
Missing Authorization in Kibana Leading to Information Discl - CVE-2026-63261
Uncontrolled Resource Consumption in Kibana Leading to Denia - CVE-2026-63260
Uncontrolled Resource Consumption in Kibana Leading to Denia - CVE-2026-63259
Authorization Bypass Through User-Controlled Key in Kibana L
Same weakness: CWE-674
- CVE-2026-58227
TLS/DTLS denial of service via unbounded recursion on cross- - CVE-2026-64194
Net::DNS versions through 1.55 for Perl allow Denial of Serv - CVE-2026-63760
SurrealDB before 3.1.0 Denial of Service via JSON Parser - CVE-2026-63759
SurrealDB before 3.1.0 Denial of Service nested type annotat - CVE-2026-63737
SurrealDB before 3.1.5 Denial of Service via deep operator c
V. Comments for CVE-2026-63144
No comments yet