CVE-2026-72638

Received Received - Intake

Uncontrolled Recursion in Elasticsearch

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth check, exhausting the thread stack and terminating the affected node.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72638

EUVD

EUVD-2026-58284

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	*
elastic	elasticsearch	to 8.19.20 (exc)
elastic	elasticsearch	to 9.4.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability is an uncontrolled recursion flaw (CWE-674) in Elasticsearch that allows a denial of service via input data manipulation (CAPEC-153). An authenticated low-privileged user with index creation permissions can send a specially crafted request containing a malformed custom analysis definition. This triggers infinite recursion without cycle or depth checks, exhausting the thread stack and crashing the affected node.

Detection Guidance

Monitor for crashes or high CPU usage in Elasticsearch nodes, particularly after low-privileged users submit custom analysis requests. Check logs for stack overflow errors or thread exhaustion events.

Impact Analysis

The impact includes service disruption as the affected Elasticsearch node crashes due to thread stack exhaustion. This can lead to downtime for applications relying on Elasticsearch, data unavailability, and potential loss of access to indexed data. The attack requires only low privileges and no special conditions beyond index creation permissions.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by causing data unavailability or loss, which may violate availability requirements. Downtime or data corruption could result in breaches of service level agreements or regulatory obligations for data accessibility and integrity.

Mitigation Strategies

Upgrade Elasticsearch to version 8.19.20 or 9.4.5 immediately. If upgrading is not possible, restrict index creation permissions for low-privileged users as a temporary measure.

Hi! I’m here to help you understand CVE-2026-72638. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70