CVE-2026-63144

{
  "id": "CVE-2026-63144",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-21T23:18:02.343",
  "lastModified": "2026-10-24T17:10:00.220",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that terminates the affected node. In single-node deployments, this results in complete service outage; in multi-node clusters, it causes repeated node restarts and sustained availability degradation."
    },
    {
      "lang": "es",
      "value": "Recursión Incontrolada (CWE-674) en Elasticsearch puede llevar a una denegación de servicio a través de una solicitud de búsqueda especialmente diseñada enviada por un usuario autenticado con privilegios bajos. Un usuario con acceso de lectura al índice puede enviar una solicitud que desencadena un procesamiento recursivo ilimitado dentro del componente de evaluación de consultas de Elasticsearch, causando un error fatal que termina el nodo afectado. En implementaciones de un solo nodo, esto resulta en una interrupción completa del servicio; en clústeres de varios nodos, causa reinicios repetidos de nodos y una degradación sostenida de la disponibilidad."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Elastic",
          "product": "Elasticsearch",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "9.4.0",
              "lessThanOrEqual": "9.4.3",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "9.3.0",
              "lessThanOrEqual": "9.3.7",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "8.19.0",
              "lessThanOrEqual": "8.19.18",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-22T13:23:19.625583Z",
          "id": "CVE-2026-63144",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "8.19.0",
              "versionEndExcluding": "8.19.19",
              "matchCriteriaId": "B6FF2B4B-ED0E-40D0-974A-CC3F6967BDC3"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "9.3.0",
              "versionEndExcluding": "9.3.8",
              "matchCriteriaId": "700D3B63-7050-4288-A12F-1325B5C808E5"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "9.4.0",
              "versionEndExcluding": "9.4.4",
              "matchCriteriaId": "54F14824-0093-4DA8-95AD-ED8F481722FC"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-68/388571",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}