CVE-2026-63144

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-63144

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63144.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-63144

Aliases

BIT-elasticsearch-2026-63144

Related

CGA-ffm9-6x96-c2fc

Published

2026-07-21T22:26:43.138Z

Modified

2026-08-05T14:57:02.310720763Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Details

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via a specially crafted search request submitted by a low-privileged authenticated user. A user with read-level index access can submit a request that triggers unbounded recursive processing within the Elasticsearch query evaluation component, causing a fatal error that terminates the affected node. In single-node deployments, this results in complete service outage; in multi-node clusters, it causes repeated node restarts and sustained availability degradation.

Database specific

{
    "cna_assigner": "elastic",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63144.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "9.4.0"
                },
                {
                    "last_affected": "9.4.3"
                },
                {
                    "introduced": "9.3.0"
                },
                {
                    "last_affected": "9.3.7"
                },
                {
                    "introduced": "8.19.0"
                },
                {
                    "last_affected": "8.19.18"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-674"
    ]
}

References

Affected packages

Git / github.com/elastic/elasticsearch

Affected ranges

Type

GIT

Repo

https://github.com/elastic/elasticsearch

Events

Introduced

93788a8c2882eb5b606510680fac214cff1c7a22

Fixed

0b6bd198d583b8566336c0db61afb70b346c6882

Introduced

17b451d8979a29e31935fe1eb901310350b30e62

Fixed

171dd53e53c29b91f45d2d87857a3f74db48cca5

Introduced

2e8528e92361c3399724226deaf2b46f933e925b

Fixed

77cd231096e56b56ac1d24445a9430a252622e6d

Database specific

{
    "extracted_events": [
        {
            "introduced": "8.19.0"
        },
        {
            "fixed": "8.19.19"
        },
        {
            "introduced": "9.3.0"
        },
        {
            "fixed": "9.3.8"
        },
        {
            "introduced": "9.4.0"
        },
        {
            "fixed": "9.4.4"
        }
    ],
    "cpe": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE"
}

Affected versions

v8.*

v8.19.0

v8.19.1

v8.19.10

v8.19.11

v8.19.12

v8.19.13

v8.19.14

v8.19.15

v8.19.16

v8.19.17

v8.19.18

v8.19.2

v8.19.3

v8.19.4

v8.19.5

v8.19.6

v8.19.7

v8.19.8

v8.19.9

v9.*

v9.3.0

v9.3.1

v9.3.2

v9.3.3

v9.3.4

v9.3.5

v9.3.6

v9.3.7

v9.4.0

v9.4.1

v9.4.2

v9.4.3

Database specific

vanir_signatures

[
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 443.0,
            "function_hash": "115913013950776467682935266167186214290"
        },
        "id": "CVE-2026-63144-0394a091",
        "source": "https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5",
        "target": {
            "function": "hasFieldTypedAs",
            "file": "x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/ml/utils/MlIndexAndAlias.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "length": 757.0,
            "function_hash": "195251013402414028464036428127401944068"
        },
        "id": "CVE-2026-63144-149f7c5a",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d",
        "target": {
            "function": "testMappingsUpgrade",
            "file": "x-pack/qa/rolling-upgrade/src/test/java/org/elasticsearch/upgrades/MlMappingsUpgradeIT.java"
        }
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 1809.0,
            "function_hash": "161461265920098109707747385294147369779"
        },
        "id": "CVE-2026-63144-191f6e87",
        "source": "https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d",
        "target": {
            "function": "emitAdvisoryNotifications",
            "file": "x-pack/plugin/ml/src/main/java/org/elasticsearch/xpack/ml/MlAnomaliesIndexUpdate.java"
        }
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "81816716326784163141037864156461492390",
                "193457615837810166023961203333335140451",
                "219949312864961936290517385645475595766",
                "193492332273642270123780157420855738475",
                "109134945049513130160940169446777743717",
                "117749742539505017103393899150508650276",
                "327484658846402275517677001025878754632",
                "88277128083084399881468861707085467538",
                "261752105453815012587785041956160391569",
                "45219006148435694893618332155695206738",
                "247400239131959349329922561927948738354",
                "297143970384114240916019390040752528710",
                "219561097176965364021383399693993096195",
                "174756042447011514348682282304277857750",
                "295187533307863769403119595053335806808",
                "127757002294872223858010470453881573595",
                "76127827453759183834786055401076437523",
                "27862674806732483010218336574864014860",
                "139168849936502340267087795027387029590",
                "335161156717404889718272437713634409769",
                "242204158689472787917814084807122224632",
                "228351892385528956460654896704676575935",
                "108930408417477068391252722732201965832"
            ]
        },
        "id": "CVE-2026-63144-2ecb32d4",
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "source": "https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5",
        "target": {
            "file": "x-pack/plugin/ml/src/test/java/org/elasticsearch/xpack/ml/MlAnomaliesIndexUpdateTests.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "81816716326784163141037864156461492390",
                "193457615837810166023961203333335140451",
                "219949312864961936290517385645475595766",
                "193492332273642270123780157420855738475",
                "109134945049513130160940169446777743717",
                "117749742539505017103393899150508650276",
                "327484658846402275517677001025878754632",
                "88277128083084399881468861707085467538",
                "261752105453815012587785041956160391569",
                "45219006148435694893618332155695206738",
                "247400239131959349329922561927948738354",
                "297143970384114240916019390040752528710",
                "219561097176965364021383399693993096195",
                "174756042447011514348682282304277857750",
                "295187533307863769403119595053335806808",
                "127757002294872223858010470453881573595",
                "76127827453759183834786055401076437523",
                "27862674806732483010218336574864014860",
                "139168849936502340267087795027387029590",
                "335161156717404889718272437713634409769",
                "242204158689472787917814084807122224632",
                "228351892385528956460654896704676575935",
                "108930408417477068391252722732201965832"
            ]
        },
        "id": "CVE-2026-63144-2fdbad82",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d",
        "target": {
            "file": "x-pack/plugin/ml/src/test/java/org/elasticsearch/xpack/ml/MlAnomaliesIndexUpdateTests.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "291831910690966635218544031672950971478",
                "161152085631897994744104891500764725967",
                "127236844828659388597695288999749917490",
                "261379068811515202666545085705261440192",
                "337682173461037959368100046130311712933",
                "208689412399050376270863926713279996472",
                "233907370603805937211272082051031503525",
                "190417235538415989055244158763197593722"
            ]
        },
        "id": "CVE-2026-63144-4df5c1e0",
        "signature_type": "Line",
        "source": "https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5",
        "target": {
            "file": "x-pack/qa/rolling-upgrade/src/test/java/org/elasticsearch/upgrades/MlMappingsUpgradeIT.java"
        }
    },
    {
        "id": "CVE-2026-63144-4ff69ccd",
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "101393873990096950420991800416251882918",
                "23490955719992678536167815105830831478",
                "275894198653151692933552380072493919347",
                "202501215400856585332211908356249536154",
                "38093348454503211711412222191970061779",
                "245246626249461445125795220025727028592",
                "180958960369218863836974260262140085967",
                "337350380980350042081781305366538775470",
                "209841966927085880094961636819164294326",
                "161393650047555658935815194508550352145",
                "330517082616902116482067993370942531899",
                "139204962687075029824507759713221564811",
                "23092223225320115423316205456624802397",
                "37420460032820905945586347346833340838",
                "56751750874276172321310225949913672733",
                "139074372557140290886430200439833044447",
                "141385189185576989096725233165411591300",
                "206795474029433025082976745152568547550",
                "198930134595639097471839755328603906939",
                "159807356369538152020721402072228673398",
                "117728750679808310613840053309847667139",
                "172906292808846080081860718130397529035",
                "77382181164524361686824059687819226277",
                "81986912303227812355627883674974956034",
                "245767764611893032166803726880040920216",
                "231099459878349177561531680968163033991",
                "6669464796606121548655461477703233517",
                "135583465348717599625336164574164606818",
                "242389645836035778480535609937826583277",
                "111675281323712967699314260735726811809",
                "165445570640752170002877819503430379486",
                "166261080474479085574148431053135176552",
                "109311873620279040957844750750051860908",
                "246755689251828643152877627567504552117",
                "239899546813507800298746642496596055672",
                "212209778102963534965342299609543145657",
                "282878794880246854237680563971348320616",
                "74624459302890992150581015592478906823",
                "173196531197277496905860757850433510424"
            ]
        },
        "source": "https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d",
        "target": {
            "file": "x-pack/plugin/ml/src/main/java/org/elasticsearch/xpack/ml/MlAnomaliesIndexUpdate.java"
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "130974301542137558840448047842862618269",
                "310384723823813034858297363478666431577"
            ]
        },
        "id": "CVE-2026-63144-5117cffa",
        "source": "https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d",
        "target": {
            "file": "x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/ml/utils/MlIndexAndAliasTests.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "130974301542137558840448047842862618269",
                "310384723823813034858297363478666431577"
            ]
        },
        "id": "CVE-2026-63144-5cd5b1b7",
        "signature_type": "Line",
        "source": "https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5",
        "target": {
            "file": "x-pack/plugin/core/src/test/java/org/elasticsearch/xpack/core/ml/utils/MlIndexAndAliasTests.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "233121128229985219156668576977333876288",
                "322038067866141381526771770641116867245",
                "241430259805230103725201070300611475508",
                "71318714060438215369602882120931554844",
                "19463283512534906609410116339369250684",
                "103496732783466577522595948932409730311",
                "155310668681586578284879423735099690318",
                "63301931713071047032833396515427666185",
                "172640144808196375156343472350222055588",
                "229896768205556589988297775201735715505",
                "47208004096404474157949582568811506150",
                "126854002759364804916266098874108951477",
                "14107338448903472933351885960178041593",
                "66745378341942989349900429020686187568",
                "262821386059642390664811956572796391799",
                "31104652174867756272822497479626521413",
                "151910984870007046939085084370763218351"
            ]
        },
        "id": "CVE-2026-63144-6460fc3c",
        "signature_type": "Line",
        "source": "https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5",
        "target": {
            "file": "x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/ml/utils/MlIndexAndAlias.java"
        }
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 1255.0,
            "function_hash": "303281486317530552893821687171494518785"
        },
        "id": "CVE-2026-63144-64cf664e",
        "source": "https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d",
        "target": {
            "function": "healOneBadIndex",
            "file": "x-pack/plugin/ml/src/main/java/org/elasticsearch/xpack/ml/MlAnomaliesIndexUpdate.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "101393873990096950420991800416251882918",
                "23490955719992678536167815105830831478",
                "275894198653151692933552380072493919347",
                "202501215400856585332211908356249536154",
                "38093348454503211711412222191970061779",
                "245246626249461445125795220025727028592",
                "180958960369218863836974260262140085967",
                "337350380980350042081781305366538775470",
                "209841966927085880094961636819164294326",
                "161393650047555658935815194508550352145",
                "330517082616902116482067993370942531899",
                "139204962687075029824507759713221564811",
                "23092223225320115423316205456624802397",
                "37420460032820905945586347346833340838",
                "56751750874276172321310225949913672733",
                "139074372557140290886430200439833044447",
                "141385189185576989096725233165411591300",
                "206795474029433025082976745152568547550",
                "198930134595639097471839755328603906939",
                "159807356369538152020721402072228673398",
                "117728750679808310613840053309847667139",
                "172906292808846080081860718130397529035",
                "77382181164524361686824059687819226277",
                "81986912303227812355627883674974956034",
                "245767764611893032166803726880040920216",
                "231099459878349177561531680968163033991",
                "6669464796606121548655461477703233517",
                "135583465348717599625336164574164606818",
                "242389645836035778480535609937826583277",
                "111675281323712967699314260735726811809",
                "165445570640752170002877819503430379486",
                "166261080474479085574148431053135176552",
                "109311873620279040957844750750051860908",
                "246755689251828643152877627567504552117",
                "239899546813507800298746642496596055672",
                "212209778102963534965342299609543145657",
                "282878794880246854237680563971348320616",
                "74624459302890992150581015592478906823",
                "173196531197277496905860757850433510424"
            ]
        },
        "id": "CVE-2026-63144-7d2dcc21",
        "signature_type": "Line",
        "source": "https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5",
        "target": {
            "file": "x-pack/plugin/ml/src/main/java/org/elasticsearch/xpack/ml/MlAnomaliesIndexUpdate.java"
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "280077327868295105608486500378173092851",
                "43015048598310775409495333102726391169",
                "137751066797260795582560576962541718966",
                "142113089162365310946470839866993266027"
            ]
        },
        "id": "CVE-2026-63144-8221ca5e",
        "source": "https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d",
        "target": {
            "file": "x-pack/plugin/ml/src/main/java/org/elasticsearch/xpack/ml/MlIndexTemplateRegistry.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "length": 1255.0,
            "function_hash": "303281486317530552893821687171494518785"
        },
        "id": "CVE-2026-63144-83301d6d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5",
        "target": {
            "function": "healOneBadIndex",
            "file": "x-pack/plugin/ml/src/main/java/org/elasticsearch/xpack/ml/MlAnomaliesIndexUpdate.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "length": 1809.0,
            "function_hash": "161461265920098109707747385294147369779"
        },
        "id": "CVE-2026-63144-89723ca9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5",
        "target": {
            "function": "emitAdvisoryNotifications",
            "file": "x-pack/plugin/ml/src/main/java/org/elasticsearch/xpack/ml/MlAnomaliesIndexUpdate.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "280077327868295105608486500378173092851",
                "43015048598310775409495333102726391169",
                "137751066797260795582560576962541718966",
                "142113089162365310946470839866993266027"
            ]
        },
        "id": "CVE-2026-63144-afcc8302",
        "signature_type": "Line",
        "source": "https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5",
        "target": {
            "file": "x-pack/plugin/ml/src/main/java/org/elasticsearch/xpack/ml/MlIndexTemplateRegistry.java"
        }
    },
    {
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "233121128229985219156668576977333876288",
                "322038067866141381526771770641116867245",
                "241430259805230103725201070300611475508",
                "71318714060438215369602882120931554844",
                "19463283512534906609410116339369250684",
                "103496732783466577522595948932409730311",
                "155310668681586578284879423735099690318",
                "63301931713071047032833396515427666185",
                "172640144808196375156343472350222055588",
                "229896768205556589988297775201735715505",
                "47208004096404474157949582568811506150",
                "126854002759364804916266098874108951477",
                "14107338448903472933351885960178041593",
                "66745378341942989349900429020686187568",
                "262821386059642390664811956572796391799",
                "31104652174867756272822497479626521413",
                "151910984870007046939085084370763218351"
            ]
        },
        "id": "CVE-2026-63144-b9801bd3",
        "source": "https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d",
        "target": {
            "file": "x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/ml/utils/MlIndexAndAlias.java"
        }
    },
    {
        "id": "CVE-2026-63144-bb12dc35",
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "291831910690966635218544031672950971478",
                "161152085631897994744104891500764725967",
                "127236844828659388597695288999749917490",
                "261379068811515202666545085705261440192",
                "337682173461037959368100046130311712933",
                "208689412399050376270863926713279996472",
                "233907370603805937211272082051031503525",
                "190417235538415989055244158763197593722"
            ]
        },
        "source": "https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d",
        "target": {
            "file": "x-pack/qa/rolling-upgrade/src/test/java/org/elasticsearch/upgrades/MlMappingsUpgradeIT.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 443.0,
            "function_hash": "115913013950776467682935266167186214290"
        },
        "id": "CVE-2026-63144-bc609ea3",
        "signature_type": "Function",
        "source": "https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d",
        "target": {
            "function": "hasFieldTypedAs",
            "file": "x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/ml/utils/MlIndexAndAlias.java"
        }
    },
    {
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "length": 757.0,
            "function_hash": "195251013402414028464036428127401944068"
        },
        "id": "CVE-2026-63144-bebcec38",
        "source": "https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5",
        "target": {
            "function": "testMappingsUpgrade",
            "file": "x-pack/qa/rolling-upgrade/src/test/java/org/elasticsearch/upgrades/MlMappingsUpgradeIT.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "55892219538835031952319089164074182258",
                "98893125584566396768016509024864438414",
                "19458546747287293758961852067136502121",
                "184762767260389321870124416427883759205",
                "111219214059868615047400935392923393010",
                "45724314446742059907257730571042785532",
                "179713398058643943713754786096284698281"
            ]
        },
        "id": "CVE-2026-63144-cfefdc32",
        "signature_type": "Line",
        "source": "https://github.com/elastic/elasticsearch/commit/171dd53e53c29b91f45d2d87857a3f74db48cca5",
        "target": {
            "file": "x-pack/plugin/ml/src/test/java/org/elasticsearch/xpack/ml/MlIndexTemplateRegistryTests.java"
        }
    },
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "55892219538835031952319089164074182258",
                "98893125584566396768016509024864438414",
                "19458546747287293758961852067136502121",
                "184762767260389321870124416427883759205",
                "111219214059868615047400935392923393010",
                "45724314446742059907257730571042785532",
                "179713398058643943713754786096284698281"
            ]
        },
        "id": "CVE-2026-63144-f563a205",
        "signature_type": "Line",
        "source": "https://github.com/elastic/elasticsearch/commit/77cd231096e56b56ac1d24445a9430a252622e6d",
        "target": {
            "file": "x-pack/plugin/ml/src/test/java/org/elasticsearch/xpack/ml/MlIndexTemplateRegistryTests.java"
        }
    }
]

vanir_signatures_modified

"2026-08-05T08:56:53Z"

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63144.json"