CVE-2026-115290

The record

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.

Affected packages

Related vulnerabilities

• CVE-2026-121092 Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote… CWE-674
• CVE-2026-63475 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. CWE-674
• CVE-2026-121423 SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows… CWE-674
• CVE-2026-120689 HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in… CWE-674
• CVE-2026-101180 DoS vulnerability in the file parsing module. CWE-674
• CVE-2026-120135 Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. CWE-674
• CVE-2026-62303 Pistache is a high-performance REST toolkit written in C++. CWE-674
• CVE-2026-61847 Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3… CWE-674