CVE-2026-103008

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>py312-elasticsearch</name>
	<range><lt>8.19.23</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to Denial
	of Service via a specially crafted request that causes the server to
	construct and process a deeply nested data structure with no bound on
	recursion depth. Elasticsearch contains an uncontrolled recursion
	weakness in how it builds and serializes geometry values produced by
	scripted runtime fields. Unlike geometry supplied as text, which is
	subject to a nesting-depth limit, geometry constructed from a script's
	output is not bounded. An authenticated user with read access to a
	single index can submit a request defining such a field with a script
	that produces a deeply nested structure. Processing this request
	recurses past the available stack space, causing the affected node to
	terminate. The node does not recover automatically on all deployments
	and may require manual intervention to restore service.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2026-103008</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2026-103008</url>
    </references>
    <dates>
      <discovery>2026-10-06</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>