{"id":"CVE-2026-63144","summary":"Uncontrolled Recursion in Elasticsearch Leading to Denial of Service","details":"Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that terminates the affected node. In single-node deployments, this results in complete service outage; in multi-node clusters, it causes repeated node restarts and sustained availability degradation.","aliases":["BIT-elasticsearch-2026-63144"],"modified":"2026-08-05T14:57:02.310720763Z","published":"2026-07-21T22:26:43.138Z","related":["CGA-ffm9-6x96-c2fc"],"database_specific":{"cna_assigner":"elastic","cwe_ids":["CWE-674"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63144.json","unresolved_ranges":[{"extracted_events":[{"introduced":"9.4.0"},{"last_affected":"9.4.3"},{"introduced":"9.3.0"},{"last_affected":"9.3.7"},{"introduced":"8.19.0"},{"last_affected":"8.19.18"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://discuss.elastic.co/t/elasticsearch-8-19-19-9-3-8-9-4-4-security-update-esa-2026-68/388571"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63144.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63144"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/elasticsearch","events":[{"introduced":"93788a8c2882eb5b606510680fac214cff1c7a22"},{"fixed":"0b6bd198d583b8566336c0db61afb70b346c6882"},{"introduced":"17b451d8979a29e31935fe1eb901310350b30e62"},{"fixed":"171dd53e53c29b91f45d2d87857a3f74db48cca5"},{"introduced":"2e8528e92361c3399724226deaf2b46f933e925b"},{"fixed":"77cd231096e56b56ac1d24445a9430a252622e6d"}],"database_specific":{"cpe":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"8.19.0"},{"fixed":"8.19.19"},{"introduced":"9.3.0"},{"fixed":"9.3.8"},{"introduced":"9.4.0"},{"fixed":"9.4.4"}],"source":"CPE_RANGE"}}],"versions":["v8.19.18","v9.3.7","v9.4.3","v9.3.6","v8.19.17","v8.19.16","v9.4.2","v9.3.5","v9.4.1","v9.4.0","v8.19.15","v9.3.4","v8.19.14","v9.3.3","v9.3.2","v8.19.13","v9.3.1","v8.19.12","v9.3.0","v8.19.11","v8.19.10","v8.19.9","v8.19.8","v8.19.7","v8.19.6","v8.19.5","v8.19.4","v8.19.3","v8.19.2","v8.19.1","v8.19.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63144.json","vanir_signatures_modified":"2026-08-05T08:56:53Z","vanir_signatures":[{"id":"CVE-2026-63144-0394a091","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5","target":{"file":"x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/ml/utils/MlIndexAndAlias.java","function":"hasFieldTypedAs"},"deprecated":false,"digest":{"function_hash":"115913013950776467682935266167186214290","length":443}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d","target":{"function":"testMappingsUpgrade","file":"x-pack/qa/rolling-upgrade/src/test/java/org/elasticsearch/upgrades/MlMappingsUpgradeIT.java"},"deprecated":false,"digest":{"function_hash":"195251013402414028464036428127401944068","length":757},"id":"CVE-2026-63144-149f7c5a"},{"signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d","target":{"file":"x-pack/plugin/ml/src/main/java/org/elasticsearch/xpack/ml/MlAnomaliesIndexUpdate.java","function":"emitAdvisoryNotifications"},"deprecated":false,"digest":{"function_hash":"161461265920098109707747385294147369779","length":1809},"id":"CVE-2026-63144-191f6e87","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5","target":{"file":"x-pack/plugin/ml/src/test/java/org/elasticsearch/xpack/ml/MlAnomaliesIndexUpdateTests.java"},"deprecated":false,"digest":{"line_hashes":["81816716326784163141037864156461492390","193457615837810166023961203333335140451","219949312864961936290517385645475595766","193492332273642270123780157420855738475","109134945049513130160940169446777743717","117749742539505017103393899150508650276","327484658846402275517677001025878754632","88277128083084399881468861707085467538","261752105453815012587785041956160391569","45219006148435694893618332155695206738","247400239131959349329922561927948738354","297143970384114240916019390040752528710","219561097176965364021383399693993096195","174756042447011514348682282304277857750","295187533307863769403119595053335806808","127757002294872223858010470453881573595","76127827453759183834786055401076437523","27862674806732483010218336574864014860","139168849936502340267087795027387029590","335161156717404889718272437713634409769","242204158689472787917814084807122224632","228351892385528956460654896704676575935","108930408417477068391252722732201965832"],"threshold":0.9},"id":"CVE-2026-63144-2ecb32d4"},{"id":"CVE-2026-63144-2fdbad82","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d","target":{"file":"x-pack/plugin/ml/src/test/java/org/elasticsearch/xpack/ml/MlAnomaliesIndexUpdateTests.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["81816716326784163141037864156461492390","193457615837810166023961203333335140451","219949312864961936290517385645475595766","193492332273642270123780157420855738475","109134945049513130160940169446777743717","117749742539505017103393899150508650276","327484658846402275517677001025878754632","88277128083084399881468861707085467538","261752105453815012587785041956160391569","45219006148435694893618332155695206738","247400239131959349329922561927948738354","297143970384114240916019390040752528710","219561097176965364021383399693993096195","174756042447011514348682282304277857750","295187533307863769403119595053335806808","127757002294872223858010470453881573595","76127827453759183834786055401076437523","27862674806732483010218336574864014860","139168849936502340267087795027387029590","335161156717404889718272437713634409769","242204158689472787917814084807122224632","228351892385528956460654896704676575935","108930408417477068391252722732201965832"]}},{"source":"https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5","target":{"file":"x-pack/qa/rolling-upgrade/src/test/java/org/elasticsearch/upgrades/MlMappingsUpgradeIT.java"},"deprecated":false,"digest":{"line_hashes":["291831910690966635218544031672950971478","161152085631897994744104891500764725967","127236844828659388597695288999749917490","261379068811515202666545085705261440192","337682173461037959368100046130311712933","208689412399050376270863926713279996472","233907370603805937211272082051031503525","190417235538415989055244158763197593722"],"threshold":0.9},"id":"CVE-2026-63144-4df5c1e0","signature_type":"Line","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d","target":{"file":"x-pack/plugin/ml/src/main/java/org/elasticsearch/xpack/ml/MlAnomaliesIndexUpdate.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["101393873990096950420991800416251882918","23490955719992678536167815105830831478","275894198653151692933552380072493919347","202501215400856585332211908356249536154","38093348454503211711412222191970061779","245246626249461445125795220025727028592","180958960369218863836974260262140085967","337350380980350042081781305366538775470","209841966927085880094961636819164294326","161393650047555658935815194508550352145","330517082616902116482067993370942531899","139204962687075029824507759713221564811","23092223225320115423316205456624802397","37420460032820905945586347346833340838","56751750874276172321310225949913672733","139074372557140290886430200439833044447","141385189185576989096725233165411591300","206795474029433025082976745152568547550","198930134595639097471839755328603906939","159807356369538152020721402072228673398","117728750679808310613840053309847667139","172906292808846080081860718130397529035","77382181164524361686824059687819226277","81986912303227812355627883674974956034","245767764611893032166803726880040920216","231099459878349177561531680968163033991","6669464796606121548655461477703233517","135583465348717599625336164574164606818","242389645836035778480535609937826583277","111675281323712967699314260735726811809","165445570640752170002877819503430379486","166261080474479085574148431053135176552","109311873620279040957844750750051860908","246755689251828643152877627567504552117","239899546813507800298746642496596055672","212209778102963534965342299609543145657","282878794880246854237680563971348320616","74624459302890992150581015592478906823","173196531197277496905860757850433510424"]},"id":"CVE-2026-63144-4ff69ccd"},{"deprecated":false,"digest":{"line_hashes":["130974301542137558840448047842862618269","310384723823813034858297363478666431577"],"threshold":0.9},"id":"CVE-2026-63144-5117cffa","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d","target":{"file":"x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/ml/utils/MlIndexAndAliasTests.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5","target":{"file":"x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/ml/utils/MlIndexAndAliasTests.java"},"deprecated":false,"digest":{"line_hashes":["130974301542137558840448047842862618269","310384723823813034858297363478666431577"],"threshold":0.9},"id":"CVE-2026-63144-5cd5b1b7"},{"deprecated":false,"digest":{"line_hashes":["233121128229985219156668576977333876288","322038067866141381526771770641116867245","241430259805230103725201070300611475508","71318714060438215369602882120931554844","19463283512534906609410116339369250684","103496732783466577522595948932409730311","155310668681586578284879423735099690318","63301931713071047032833396515427666185","172640144808196375156343472350222055588","229896768205556589988297775201735715505","47208004096404474157949582568811506150","126854002759364804916266098874108951477","14107338448903472933351885960178041593","66745378341942989349900429020686187568","262821386059642390664811956572796391799","31104652174867756272822497479626521413","151910984870007046939085084370763218351"],"threshold":0.9},"id":"CVE-2026-63144-6460fc3c","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5","target":{"file":"x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/ml/utils/MlIndexAndAlias.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d","target":{"file":"x-pack/plugin/ml/src/main/java/org/elasticsearch/xpack/ml/MlAnomaliesIndexUpdate.java","function":"healOneBadIndex"},"deprecated":false,"digest":{"function_hash":"303281486317530552893821687171494518785","length":1255},"id":"CVE-2026-63144-64cf664e"},{"digest":{"line_hashes":["101393873990096950420991800416251882918","23490955719992678536167815105830831478","275894198653151692933552380072493919347","202501215400856585332211908356249536154","38093348454503211711412222191970061779","245246626249461445125795220025727028592","180958960369218863836974260262140085967","337350380980350042081781305366538775470","209841966927085880094961636819164294326","161393650047555658935815194508550352145","330517082616902116482067993370942531899","139204962687075029824507759713221564811","23092223225320115423316205456624802397","37420460032820905945586347346833340838","56751750874276172321310225949913672733","139074372557140290886430200439833044447","141385189185576989096725233165411591300","206795474029433025082976745152568547550","198930134595639097471839755328603906939","159807356369538152020721402072228673398","117728750679808310613840053309847667139","172906292808846080081860718130397529035","77382181164524361686824059687819226277","81986912303227812355627883674974956034","245767764611893032166803726880040920216","231099459878349177561531680968163033991","6669464796606121548655461477703233517","135583465348717599625336164574164606818","242389645836035778480535609937826583277","111675281323712967699314260735726811809","165445570640752170002877819503430379486","166261080474479085574148431053135176552","109311873620279040957844750750051860908","246755689251828643152877627567504552117","239899546813507800298746642496596055672","212209778102963534965342299609543145657","282878794880246854237680563971348320616","74624459302890992150581015592478906823","173196531197277496905860757850433510424"],"threshold":0.9},"id":"CVE-2026-63144-7d2dcc21","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5","target":{"file":"x-pack/plugin/ml/src/main/java/org/elasticsearch/xpack/ml/MlAnomaliesIndexUpdate.java"},"deprecated":false},{"source":"https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d","target":{"file":"x-pack/plugin/ml/src/main/java/org/elasticsearch/xpack/ml/MlIndexTemplateRegistry.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["280077327868295105608486500378173092851","43015048598310775409495333102726391169","137751066797260795582560576962541718966","142113089162365310946470839866993266027"]},"id":"CVE-2026-63144-8221ca5e","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"303281486317530552893821687171494518785","length":1255},"id":"CVE-2026-63144-83301d6d","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5","target":{"function":"healOneBadIndex","file":"x-pack/plugin/ml/src/main/java/org/elasticsearch/xpack/ml/MlAnomaliesIndexUpdate.java"},"deprecated":false},{"id":"CVE-2026-63144-89723ca9","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5","target":{"file":"x-pack/plugin/ml/src/main/java/org/elasticsearch/xpack/ml/MlAnomaliesIndexUpdate.java","function":"emitAdvisoryNotifications"},"deprecated":false,"digest":{"function_hash":"161461265920098109707747385294147369779","length":1809}},{"signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5","target":{"file":"x-pack/plugin/ml/src/main/java/org/elasticsearch/xpack/ml/MlIndexTemplateRegistry.java"},"deprecated":false,"digest":{"line_hashes":["280077327868295105608486500378173092851","43015048598310775409495333102726391169","137751066797260795582560576962541718966","142113089162365310946470839866993266027"],"threshold":0.9},"id":"CVE-2026-63144-afcc8302","signature_type":"Line"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["233121128229985219156668576977333876288","322038067866141381526771770641116867245","241430259805230103725201070300611475508","71318714060438215369602882120931554844","19463283512534906609410116339369250684","103496732783466577522595948932409730311","155310668681586578284879423735099690318","63301931713071047032833396515427666185","172640144808196375156343472350222055588","229896768205556589988297775201735715505","47208004096404474157949582568811506150","126854002759364804916266098874108951477","14107338448903472933351885960178041593","66745378341942989349900429020686187568","262821386059642390664811956572796391799","31104652174867756272822497479626521413","151910984870007046939085084370763218351"]},"id":"CVE-2026-63144-b9801bd3","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d","target":{"file":"x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/ml/utils/MlIndexAndAlias.java"}},{"id":"CVE-2026-63144-bb12dc35","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d","target":{"file":"x-pack/qa/rolling-upgrade/src/test/java/org/elasticsearch/upgrades/MlMappingsUpgradeIT.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["291831910690966635218544031672950971478","161152085631897994744104891500764725967","127236844828659388597695288999749917490","261379068811515202666545085705261440192","337682173461037959368100046130311712933","208689412399050376270863926713279996472","233907370603805937211272082051031503525","190417235538415989055244158763197593722"]}},{"source":"https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d","target":{"function":"hasFieldTypedAs","file":"x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/ml/utils/MlIndexAndAlias.java"},"deprecated":false,"digest":{"function_hash":"115913013950776467682935266167186214290","length":443},"id":"CVE-2026-63144-bc609ea3","signature_type":"Function","signature_version":"v1"},{"digest":{"length":757,"function_hash":"195251013402414028464036428127401944068"},"id":"CVE-2026-63144-bebcec38","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5","target":{"file":"x-pack/qa/rolling-upgrade/src/test/java/org/elasticsearch/upgrades/MlMappingsUpgradeIT.java","function":"testMappingsUpgrade"},"deprecated":false},{"id":"CVE-2026-63144-cfefdc32","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5","target":{"file":"x-pack/plugin/ml/src/test/java/org/elasticsearch/xpack/ml/MlIndexTemplateRegistryTests.java"},"deprecated":false,"digest":{"line_hashes":["55892219538835031952319089164074182258","98893125584566396768016509024864438414","19458546747287293758961852067136502121","184762767260389321870124416427883759205","111219214059868615047400935392923393010","45724314446742059907257730571042785532","179713398058643943713754786096284698281"],"threshold":0.9}},{"id":"CVE-2026-63144-f563a205","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d","target":{"file":"x-pack/plugin/ml/src/test/java/org/elasticsearch/xpack/ml/MlIndexTemplateRegistryTests.java"},"deprecated":false,"digest":{"line_hashes":["55892219538835031952319089164074182258","98893125584566396768016509024864438414","19458546747287293758961852067136502121","184762767260389321870124416427883759205","111219214059868615047400935392923393010","45724314446742059907257730571042785532","179713398058643943713754786096284698281"],"threshold":0.9}}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}