CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2026-102408

Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch can lead to denial of service via Regular Expression Exponential Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking strategy accepts a list of user-supplied regular expressions used as text-splitting separators, without validating their computational complexity or bounding their execution time. An authenticated user with read access to any text-based index can submit a specially crafted regular expression that triggers catastrophic backtracking, consuming excessive CPU on Elasticsearch worker threads and degrading query throughput for other tenants on the affected node. The cluster does not crash as a result of this issue.

Score
4.3 medium
Published
2026-10-06
Links
NVD · cve.org

Matched ports (1)

PortPackageVersionStatusMaintainer
textproc/py-elasticsearchpy312-elasticsearch9.5.1unaddressedsunpoet@FreeBSD.org

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>py312-elasticsearch</name>
	<range><lt>8.19.22</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Inefficient Regular Expression Complexity (CWE-1333) in Elasticsearch
	can lead to denial of service via Regular Expression Exponential
	Blowup (CAPEC-492). The ES|QL CHUNK function's recursive chunking
	strategy accepts a list of user-supplied regular expressions used as
	text-splitting separators, without validating their computational
	complexity or bounding their execution time. An authenticated user
	with read access to any text-based index can submit a specially
	crafted regular expression that triggers catastrophic backtracking,
	consuming excessive CPU on Elasticsearch worker threads and degrading
	query throughput for other tenants on the affected node. The cluster
	does not crash as a result of this issue.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-102408</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-102408</url>
    </references>
    <dates>
      <discovery>2026-10-06</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>