CVE-2026-115290 is a high-severity vulnerability in Elasticsearch caused by uncontrolled recursion in handling serialized data with nested payloads. An unauthenticated attacker with network access to a cluster node can send a crafted request that triggers node termination, resulting in denial of service. No credentials are required, and the attack can be repeated against each reachable node in the cluster.