This vulnerability in Elasticsearch is due to uncontrolled recursion (CWE-674) triggered by specially crafted queries submitted by authenticated users. The excessive recursion causes excessive allocation of resources (CAPEC-130), which can result in denial of service by exhausting the affected node's resources and rendering it unavailable. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. The affected versions explicitly identified are 8.0.0, 9.0.0, and 9.4.0. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An authenticated attacker can cause denial of service on affected Elasticsearch nodes by submitting queries that trigger uncontrolled recursion, leading to excessive resource consumption and node unavailability. There is no impact on confidentiality or integrity reported, only availability is affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user access to trusted users only and monitor for unusual query patterns that may indicate attempts to exploit this vulnerability.