CVE-2026-102409

Executive Summary

CVE-2026-102409 is an uncontrolled recursion flaw (CWE-674) in Elasticsearch that permits an authenticated user holding only low privileges to trigger excessive resource allocation, terminating an Elasticsearch node and causing a denial-of-service condition. Any organization running an exposed or multi-tenant Elasticsearch cluster where untrusted or low-privilege accounts are provisioned is affected. The impact is availability-only (CVSS 6.5, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), meaning no confidentiality or integrity loss is expected, but a single low-privileged authenticated user can take down a node and, depending on cluster topology and shard placement, degrade or interrupt dependent services.

Technical Analysis

The vulnerability class is uncontrolled recursion, CWE-674. CWE-674 describes software that does not adequately bound recursion depth, so that a recursive code path can be driven to consume stack and heap resources until the process exhausts memory or crashes. The NVD description maps the resulting resource pressure to CAPEC-130 (Excessive Allocation), which is the adversary pattern of forcing a target to commit disproportionate memory, CPU, or other resources relative to the input supplied.

In Elasticsearch, the affected attack surface is any request path reachable by an authenticated principal with low privileges that internally performs recursion over user-supplied or user-influenced input without a hard depth or allocation ceiling. The exact endpoint, parameter, query DSL construct, or internal recursive routine is not disclosed in the available data; no CNA title, affected version, package list, or commit reference was provided. Accordingly, this report does not assert specific field names, API paths, or class names beyond what the description states.

Key characteristics derivable from the provided data:

• Authentication is required (PR:L). The actor must possess valid credentials for an account with low privileges — not an anonymous internet user. This narrows the realistic threat model to insider abuse, compromised low-privilege credentials, or a multi-tenant cluster where tenants hold their own credentials.
• Attack complexity is low (AC:L) and no user interaction is required (UI:N), meaning a single authenticated request or a small number of requests is sufficient; the flaw is not gated behind race conditions or unusual preconditions.
• Network reachable (AV:N). The vulnerable interface is exposed over the network, consistent with Elasticsearch's HTTP/REST API and transport layers.
• Availability-only impact (C:N/I:N/A:H). The consequence is node termination — a process crash or forced restart — rather than data disclosure or modification.
• Scope is unchanged (S:U), meaning the impact is expected to remain within the security authority of the vulnerable Elasticsearch component. However, cluster-level effects (shard reallocation, replica promotion, client failures) are operationally relevant even when CVSS scope is unchanged.

Because the recursion is "uncontrolled," the mechanism is best understood generically: attacker-controlled input causes self-referential or nested processing whose depth is not validated against a safe maximum, driving memory allocation beyond available heap or beyond configured limits, with the node process terminating. Whether termination occurs via out-of-memory kill, explicit circuit-breaker failure that escalates to process exit, or stack exhaustion cannot be determined from the supplied data.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code exists for this CVE. The attack chain below is inferred strictly from the vulnerability class and the NVD description; it does not assert specific endpoints, parameters, or payload syntax.

1. Reconnaissance and target identification. The attacker identifies an Elasticsearch cluster reachable over the network. This can be done by port scanning for the default Elasticsearch HTTP port and validating the service via its response banner/JSON root response, by interrogating cluster metadata, or by observing an application that fronts Elasticsearch. The attacker must then obtain valid low-privilege credentials — through a compromised application account, a leaked API key, tenant provisioning in a shared cluster, or default/weak credentials on a low-privilege role. No elevated privileges are needed and no user interaction is required.

2. Triggering the flaw class. With an authenticated session, the attacker submits a request that reaches the recursive code path and supplies input that increases recursion depth without a bound. In the generic CWE-674 pattern, this is input whose structure is self-similar or deeply nested such that the processing routine recursively descends once per level. Because the description does not disclose the specific construct, a defender should assume any user-influenced structure that is processed recursively — including deeply nested documents, nested query constructs, or similarly self-referential input — could be the vector. Confirmation of the exact vector requires either the vendor advisory or source-level review.

3. Execution method at the vulnerability-class level. The attack is a request-based resource exhaustion: the attacker sends the crafted request (or a small number of such requests) over the network to the authenticated interface. There is no evidence of code injection, deserialization of attacker classes, or remote code execution. The exploit primitive is allocation amplification — small input produces disproportionate internal memory/stack consumption (CAPEC-130).

4. Post-exploitation impact. The recursion consumes resources until the node process terminates. The immediate effect is loss of the targeted node: in-flight queries and indexing requests fail, and the node must restart. In a multi-node cluster, shards on the failed node are reallocated or replicas promoted, which concentrates load on remaining nodes and can cascade into further instability. Repeated triggering — since the attacker retains valid low-privilege credentials — can produce sustained or cluster-wide denial of service. No data is exfiltrated or altered per the CVSS vector.

Impact Assessment

Business impact centers on availability. Elasticsearch commonly backs search, log analytics, observability, and SIEM pipelines; a terminated node can interrupt dashboards, alerting, log ingestion, and application search features, and can blind security monitoring that depends on the cluster. Because the actor needs only low privileges, the barrier to a malicious insider or a holder of leaked tenant credentials is low, and multi-tenant or customer-facing clusters carry elevated risk of tenant-to-tenant availability abuse.

CVSS 3.1 subscores (as provided): Base score 6.5, MEDIUM. Attack Vector Network (AV:N) — remotely reachable; Attack Complexity Low (AC:L) — repeatable without special conditions; Privileges Required Low (PR:L) — authenticated low-privilege account; User Interaction None (UI:N) — no victim action needed; Scope Unchanged (S:U) — impact contained to the vulnerable component per CVSS; Confidentiality None (C:N) and Integrity None (I:N) — no data exposure or tampering; Availability High (A:H) — node termination and service loss.

Blast radius: the single targeted node is the primary victim, with secondary effects across the cluster (shard reallocation, replica promotion, load redistribution) and across dependent applications and pipelines. No EPSS score has been assigned by FIRST.org, and the CVE is not listed in CISA KEV, so there is currently no evidence of exploitation in the wild or of a known exploited-vulnerability designation.

Detection Guidance

Sigma Rule

title: Potential Elasticsearch Uncontrolled Recursion DoS Attempt (CVE-2026-102409)
id: 7c1f9a24-3b6e-4d2a-9f51-0e2c8a5d1b47
status: experimental
description: Detects repeated authenticated requests to Elasticsearch that may correspond to a CWE-674 uncontrolled recursion / excessive allocation denial-of-service attempt. Endpoint and payload fields are intentionally generic because no public PoC or specific vector is available.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102409
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1499
  - cve.2026-102409
logsource:
  category: webserver
  product: elasticsearch
detection:
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  selection_elastic:
    cs-uri-stem|contains:
      - '/_search'
      - '/_msearch'
      - '/_bulk'
      - '/_query'
  selection_depth_or_size:
    - cs-uri-query|re: '(?i)(nested|depth|recursion|levels?)'
    - sc-bytes|gt: 1000000
    - cs-uri-query|re: '(\{|\[){20,}'
  condition: selection_method and selection_elastic and selection_depth_or_size
falsepositives:
  - Legitimate bulk indexing of very large documents
  - Analytics jobs issuing deeply nested aggregations
level: medium

YARA Rule

rule EXPL_CVE_2026_102409_Elasticsearch_Recursion_DoS
{
    meta:
        description = "Heuristic detection of deeply nested self-referential structures that may trigger CWE-674 uncontrolled recursion in Elasticsearch (CVE-2026-102409). No public PoC exists; pattern is a generic recursion-amplification indicator."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102409"
        date = "2026-01-01"
        cve = "CVE-2026-102409"
        cwe = "CWE-674"
        severity = "medium"

    strings:
        $nested = "nested"
        $recurs = "recurs"
        $depth  = "depth"
        $levels = "levels"
        $brace_open = "{"
        $bracket_open = "["

    condition:
        filesize < 10MB and
        (
            any of ($nested, $recurs, $depth, $levels) and
            #brace_open > 50
        ) or
        #bracket_open > 100
}

Suricata IDS Rule

alert http any any -> any 9200 (msg:"EXPLOIT CVE-2026-102409 Elasticsearch potential uncontrolled recursion DoS attempt (deeply nested request)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/_search"; pcre:"/(?:\{|\[){50,}/R"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-dos; reference:cve,2026-102409; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102409; metadata:created_at 2026_01_01, updated_at 2026_01_01; sid:2026102409; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ network where event.category == "network" and url.path : ("/_search", "/_msearch", "/_bulk", "/_query") ]
  [ process where event.type == "end" and process.name : "java" ]

Splunk SPL Query

index=elasticsearch OR index=proxy OR index=network
(sourcetype=elasticsearch:* OR sourcetype=access_combined* OR sourcetype=pan:*)
| eval deep_input=if(match(_raw, "(\{|\[){50,}") OR match(_raw, "(?i)(nested|recursion|depth|levels?)"), 1, 0)
| where deep_input=1
| stats count AS req_count, dc(src_ip) AS srcs, values(user) AS users BY src_ip, uri_path
| where req_count > 5
| sort - req_count

Wazuh OSSEC Rule

<group name="elasticsearch,cve-2026-102409,">
  <rule id="102409" level="10" frequency="5" timeframe="60">
    <if_matched_sid>102408</if_matched_sid>
    <description>CVE-2026-102409: repeated suspicious Elasticsearch requests possibly triggering uncontrolled recursion denial of service</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>cve_2026_102409,attempted_dos,</group>
  </rule>

  <rule id="102408" level="3">
    <decoded_as>json</decoded_as>
    <url>/_search|/_msearch|/_bulk|/_query</url>
    <field name="method">POST|GET</field>
    <description>Elasticsearch recursive-input candidate request observed</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch, advisory, or vendor fix evidence was available from any tracked source, and no affected version range was supplied. The following guidance is defensive and generic to the vulnerability class; it does not correspond to a confirmed vendor fix.

1. Immediate mitigations

• Enforce least privilege and audit low-privilege roles: because PR:L is required, reduce the number of accounts that can reach the vulnerable request path and rotate credentials for applications and tenants.
• Segment and restrict network access to the Elasticsearch HTTP/transport ports; do not expose the cluster directly to untrusted networks. Place authentication and an API gateway or reverse proxy in front of the cluster.
• Apply request-level guardrails where your deployment supports them: cap request body size, cap nesting depth in a fronting proxy/WAF, and set conservative timeouts so a hung recursive request is terminated before resource exhaustion.
• Configure and monitor circuit breakers and JVM heap limits so allocation pressure fails a request rather than the process, where the platform supports it.
• Monitor node restarts and unexpected JVM exits and correlate with authenticated request patterns.

2. Patch/upgrade steps

• No vendor patch is available per tracked sources. Monitor the Elastic security advisories page for an Elasticsearch security announcement tied to CWE-674 and for associated affected-version ranges. Once a fixed release is published, upgrade all cluster nodes (rolling upgrade, one node at a time, verifying cluster health between nodes) to that version. Do not apply unverified third-party patches.

3. Long-term hardening

• Maintain a strict index of which principals can issue each class of query and periodically review role mappings.
• Enforce bounded recursion and depth limits at the application and gateway layer for any user-supplied structured input reaching Elasticsearch.
• Keep clusters off the public internet, adopt TLS with certificate-based client authentication, and integrate with an identity provider for credential lifecycle control.
• Test for resource-exhaustion behavior in staging using input-depth fuzzing against non-production clusters as part of regression and upgrade validation.
• Track CVE-2026-102409 in your vulnerability management system and re-evaluate patch confidence when the vendor publishes guidance.

References

1. NVD entry for CVE-2026-102409 — https://nvd.nist.gov/vuln/detail/CVE-2026-102409
2. CWE-674: Uncontrolled Recursion — https://cwe.mitre.org/data/definitions/674.html
3. CAPEC-130: Excessive Allocation — https://capec.mitre.org/data/definitions/130.html
4. Elastic Security Advisories (monitor for an advisory matching CWE-674 / CVE-2026-102409) — https://www.elastic.co/community/security
5. MITRE ATT&CK T1499: Endpoint Denial of Service — https://attack.mitre.org/techniques/T1499/

No known threat actor campaigns, exploit-in-the-wild evidence, CISA KEV listing, public PoC, Nuclei template, or public exploit code were identified for this CVE in the supplied data.