Bug 2547111 (CVE-2026-102408)

Summary: CVE-2026-102408 elasticsearch: elasticsearch: Denial of Service via crafted regular expressions in ES|QL CHUNK function
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: doconnor
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Elasticsearch. An authenticated attacker with read access to an index can cause a Denial of Service (DoS) by submitting queries containing specially crafted regular expressions to the ES|QL CHUNK function. Because the component does not properly restrict regular expression complexity or limit processing time, evaluating the pattern triggers excessive CPU consumption, significantly degrading query performance on the affected node.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2547790, 2547792, 2547791    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-06 19:53:49 UTC 
Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers catastrophic backtracking, consuming excessive CPU on Elasticsearch worker threads and degrading query throughput for other tenants on the affected node. The cluster does not crash as a result of this issue.