CyberRota Analysis
AI-GeneratedElasticsearch is vulnerable to a denial of service attack due to uncontrolled recursion, which can be triggered by an authenticated user with low-privileged index creation permissions. By submitting a specially crafted request with a malformed custom analysis definition, the attacker can exhaust the thread stack, causing the affected node to terminate. Organizations using Elasticsearch should prioritize addressing this vulnerability to prevent potential service disruptions.
Original NVD Description
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth check, exhausting the thread stack and terminating the affected node.