This vulnerability in Elasticsearch arises from uncontrolled recursion in the handling of custom analysis definitions. Specifically, an authenticated user with limited permissions can craft a malformed analysis definition that causes recursive resolution without safeguards against cycles or excessive depth. This recursion exhausts the thread stack, causing the node to crash and resulting in denial of service. The issue is tracked as CWE-674 and is exploitable via input data manipulation (CAPEC-153). It affects Elasticsearch versions 8.0.0 and 9.0.0. The CVSS v3.1 score is 6.5, reflecting a network attack vector with low complexity and low privileges required, no user interaction, and impact limited to availability.

Successful exploitation results in denial of service by crashing the affected Elasticsearch node due to stack exhaustion from uncontrolled recursion. There is no impact on confidentiality or integrity. The attacker requires authenticated access with low-privileged index creation permissions. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict index creation permissions to trusted users only and monitor for unusual requests involving custom analysis definitions. No official remediation or temporary fix has been published by Elastic at this time.