CyberRota Analysis
AI-GeneratedElasticsearch is vulnerable due to its failure to enforce input length restrictions on user-supplied patterns in intervals queries, allowing an authenticated user with read-only privileges to exploit this flaw. By crafting a deeply nested pattern, the user can induce unbounded recursion, leading to a stack exhaustion that crashes the Elasticsearch node and results in a denial of service. Organizations using Elasticsearch should prioritize this vulnerability to prevent potential service disruptions from unauthorized access to their search capabilities.
Original NVD Description
Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and raises a fatal error, terminating the Elasticsearch node process and causing a denial of service for that node. An authenticated user holding only read-only privileges on a single searchable index can trigger the condition with one small search request.