Segmentation faults with elasticsearch 9.1.4

[GalacticHypernova]

Elasticsearch Version

9.1.4

Installed Plugins

None - only the base elasticsearch install (and any potential first-party plugins)

Java Version

bundled

OS Version

Linux 6.8.0-85-generic #85-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep 18 15:26:59 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux - Ubuntu 24.04.3

Problem Description

Under arbitrary conditions, with seemingly no correlation to load/system state/any other definitive identifier, elasticsearch crashes with SEGV, in seemingly randomized frames. For example, it can be org.apache.lucene.search.DisjunctionDISIApproximation.nextDoc() one time, and org.apache.lucene.codecs.lucene101.Lucene101PostingsReader$BlockPostingsEnum.seekPosData(JIJI)V+5 org.apache.lucene.core@10.2.2 the other.

Steps to Reproduce

My use case:

1. Enable elasticsearch (with default security settings)
2. Create index (using official JS client):

if (!await constants.es.indices.exists({ index: 'code-search' })) {
					await constants.es.indices.create({
						index: 'code-search',
						settings: {
							index: {
								default_pipeline: 'mongodb-stripper' // this is a simple `keep` pipeline to take the necessary subsets of fields for the search
							}
						},
						mappings: {
							dynamic: false,
							properties: {
								title: { type: "text" },
								features: { type: "text" },
								tags: { type: "text", fields: { keyword: { type: "keyword", ignore_above: 256 } } },
								codeType: { type: "keyword" },
								verified: { type: "boolean" },
								isBroken: { type: "boolean" },
								isUniversal: { type: "boolean" },
								key: { type: "boolean" },
								views: { type: "unsigned_long" },
								likeCount: { type: "unsigned_long" },
								dislikeCount: { type: "unsigned_long" },
								createdAt: { type: "date" },
								lastBump: { type: "date" },
								visibility: { type: "keyword" },
								deleted: { type: "boolean" },
								envName: { type: "text" },
								owner: { type: "keyword" },
								env: { type: "keyword" }
							}
						}
					})
				}

3. Pass data to elasticsearch from mongodb
4. The app is now running correctly. Wait an undefined amount of time (could be hours, could be days)
5. Elasticsearch crashes, the app's search functionality is broken.

Logs (if relevant)

The logs from the disjunction SEGV and postings SEGV are attached below (although they aren't the only SEGV instances).
Note that they differ slightly in kernel version (postings is 2 behind), because the postings error happened before a server upgrade. This comes to show that the SEGV happens regardless of version

postings log.txt

disjunction log.txt