| Package | Affected versions | Patched versions |
|---|---|---|
| elasticsearch | ≥ 8.19.0, < 8.19.19≥ 9.3.0, < 9.3.8≥ 9.4.0, < 9.4.4 | 8.19.199.3.89.4.4 |
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that terminates the affected node. In single-node deployments, this results in complete service outage; in multi-node clusters, it causes repeated node restarts and sustained availability degradation.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free