PT-2026-54863 · Elastic · Elasticsearch

Published 2026-07-01 · Updated 2026-07-01 · CVE-2026-56148

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Elasticsearch versions prior to 8.19.17 Elasticsearch versions prior to 9.3.6 Elasticsearch versions prior to 9.4.3

Description An authenticated user can trigger a denial of service by submitting a specially crafted query. This occurs due to uncontrolled recursion, which leads to excessive resource allocation during request processing and may render the affected node unavailable.

Recommendations Update to version 8.19.17. Update to version 9.3.6. Update to version 9.4.3.

Fix

DoS

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

CVE-2026-56148

Affected Products

Elasticsearch

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-56148 · Security Note
• https://twitter.com/VulmonFeeds/status/2072409205177258097 · Twitter Post
• https://discuss.elastic.co/t/elasticsearch-8-19-17-9-3-6-9-4-3-security-update-esa-2026-42 · Note
• https://twitter.com/skraft09/status/2072346116629143818 · Twitter Post