CVE-2026-72636

Analyzed Analyzed - Analysis Complete

Uncontrolled Recursion in Elasticsearch Wildcard Matching Leads to DoS

Publication date: 2026-08-13

Last updated on: 2026-09-01

Assigner: Elastic

Description

Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of match operations performed. A search request containing a wildcard pattern with a large number of wildcard groups, evaluated against a sufficiently long name, exhausts the thread stack. Elasticsearch treats a stack overflow as an unrecoverable condition and shuts the node down, so the request terminates the affected node rather than failing gracefully.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-09-01

Generated

2026-09-03

AI Q&A

2026-08-14

EPSS Evaluated

2026-09-02

NVD

CVE-2026-72636

EUVD

EUVD-2026-58222

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	From 8.0.0 (inc) to 8.19.20 (exc)
elastic	elasticsearch	From 9.0.0 (inc) to 9.4.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability involves uncontrolled recursion in Elasticsearch's wildcard matching helper, which can cause a denial of service through excessive allocation. The matcher uses a recursive approach without limits on recursion depth or match operations, leading to thread stack exhaustion when processing complex wildcard patterns against long names. This forces Elasticsearch to shut down the affected node instead of handling the error gracefully.

Detection Guidance

Check Elasticsearch version with: curl -XGET 'http://localhost:9200'. If running versions 8.0.0-8.19.19 or 9.0.0-9.4.4, the system is vulnerable. Monitor for node crashes during wildcard searches.

Impact Analysis

If exploited, this vulnerability can terminate Elasticsearch nodes, disrupting search functionality and causing downtime. Attackers could send malicious wildcard patterns to crash nodes, leading to service unavailability and potential data access issues.

Compliance Impact

This vulnerability could impact compliance by causing unplanned Elasticsearch node shutdowns during wildcard searches, leading to potential data unavailability. For GDPR, this may disrupt access to personal data, violating Article 12 (right to access) or Article 32 (security of processing). For HIPAA, it could interrupt access to protected health information, affecting the availability requirement under the Security Rule.

Mitigation Strategies

Upgrade Elasticsearch to versions 8.19.20 or 9.4.5 immediately. No workarounds exist for unpatched systems. If upgrading is not possible, restrict access to the wildcard search endpoint to reduce exposure.

Hi! I’m here to help you understand CVE-2026-72636. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70