What is GHSA-6f4f-c5j2-2rrx?

GHSA-6f4f-c5j2-2rrx is a security advisory published by GitHub Security Advisories with High severity. Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized...

Which CVE IDs does GHSA-6f4f-c5j2-2rrx cover?

GHSA-6f4f-c5j2-2rrx covers the following CVE IDs: CVE-2026-115290. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6f4f-c5j2-2rrx?

GHSA-6f4f-c5j2-2rrx has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-6f4f-c5j2-2rrxHighCVSS 7.5

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized...

Vendor

GitHub Security Advisories

Published

November 3, 2026

Last Modified

November 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-115290 →

📋 Description

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-115290
https://discuss.elastic.co/t/elasticsearch-8-19-24-9-4-9-9-5-6-security-update-esa-2026-201/391356
https://github.com/advisories/GHSA-6f4f-c5j2-2rrx