CVE-2026-115290

{
  "etk_id": "ETK-2026-3384",
  "cve_id": "CVE-2026-115290",
  "display_id": "CVE-2026-115290",
  "ghsa_id": "GHSA-6f4f-c5j2-2rrx",
  "euvd_id": "EUVD-2026-116072",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Uncontrolled recursion denial of service in Elasticsearch",
  "summary": "Elasticsearch is affected by an uncontrolled recursion issue that can cause a node to terminate. An unauthenticated attacker can trigger the condition when they have network access to a node's remote cluster server interface, potentially affecting multiple reachable nodes.",
  "mitigation": "Restrict the remote cluster server interface to trusted hosts and networks using firewall rules and network segmentation. Apply the applicable Elasticsearch vendor update after validating the fixed release for your supported branch.",
  "vendor": "Elastic",
  "product": "Elasticsearch",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 8.10.0, <= 8.19.23",
        ">= 9.0.0, <= 9.4.8",
        ">= 9.5.0, <= 9.5.5"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Elasticsearch",
      "purl": null
    }
  ],
  "cwes": [
    674
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": 0.0041,
  "epss_percentile": 0.3575,
  "epss_asof": "2026-11-06",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 30.743950933333334,
  "t0_at": "2026-11-03T16:43:59.960000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-05T07:07:41.244571+00:00",
      "days": 1.5997833862384259,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T16:43:59.960000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-11-05T04:46:56+00:00",
      "days": 1.5020375,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T16:43:59.960000+00:00",
      "url": "https://github.com/googlesky/CVE-2026-115290"
    },
    "trigger_signal": {
      "at": "2026-11-03T16:43:59.960000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T16:43:59.960000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-115290"
    }
  }
}