Skip to content
Heist/ feed
Medium

Inefficient Regular Expression Complexity in Elasticsearch Leading to Denial of Service

Type: advisorySource: Official CVE List1 source record

Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers catastrophic backtracking, consuming excessive CPU on Elasticsearch worker threads and degrading query throughput for other tenants on the affected node. The cluster does not crash as a result of this issue.

Announced Source revision 1
Original source ↗

CVE-2026-102408

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102408

Elasticsearch

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "Elastic",
    "product": "Elasticsearch",
    "versions": [
      {
        "status": "affected",
        "version": "8.19.0",
        "versionType": "semver",
        "lessThanOrEqual": "8.19.21"
      },
      {
        "status": "affected",
        "version": "9.1.0",
        "versionType": "semver",
        "lessThanOrEqual": "9.3.8"
      },
      {
        "status": "affected",
        "version": "9.4.0",
        "versionType": "semver",
        "lessThanOrEqual": "9.4.7"
      },
      {
        "status": "affected",
        "version": "9.5.0",
        "versionType": "semver",
        "lessThanOrEqual": "9.5.4"
      }
    ],
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-102408

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#9575 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement