CVE-2026-103008

Elasticsearch has an uncontrolled recursion flaw (CWE-674) in how it builds and serializes geometry values produced by scripted runtime fields. Geometry supplied as text is limited by a nesting-depth check, but geometry constructed from a script's output is not, so a specially crafted request can force the server to process an arbitrarily deep structure. An authenticated user who only has read access to a single index can define such a field; processing recurses until the node runs out of stack space and terminates. Availability impact is high: the node may not recover by itself and can need manual intervention, with no confidentiality or integrity impact. There is no known public proof of concept and the issue is not listed in CISA KEV.

What to do: Apply Elastic's security update for this issue as soon as a fixed Elasticsearch release is available for your deployment, and restart any nodes that have already crashed so service is restored. Until then, restrict who can create or query scripted runtime fields (especially geometry scripts) to trusted users, and review index privileges so untrusted accounts do not have read access they can use to submit such scripts. Watch cluster logs and process supervisors for nodes that exit from stack overflow and do not come back on their own.