CVE-2026-103006

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>py312-elasticsearch</name>
	<range><lt>8.19.21</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial
	of Service via a specially crafted, deeply nested request submitted to
	the aggregation feature of the search API. Elasticsearch contains an
	uncontrolled recursion weakness in its search aggregation processing.
	An authenticated user with read access to a single index can submit a
	specially crafted request containing deeply nested aggregation
	definitions. Processing this request triggers unbounded recursive
	execution that exhausts the server process's available resources,
	causing the affected node to terminate. The node does not recover
	automatically and requires manual intervention to restore service.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-103006</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-103006</url>
    </references>
    <dates>
      <discovery>2026-10-06</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>