CVE-2026-72647
Received Received - Intake

Uncontrolled Recursion in Elasticsearch

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without a depth limit, exhausting the thread stack and terminating the affected node.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-14
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-72647
EUVD
EUVD-2026-58283

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
elastic elasticsearch *
elastic elasticsearch to 8.19.20 (exc)
elastic elasticsearch to 9.4.5 (exc)
elastic elasticsearch 9.5.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72647 is an uncontrolled recursion vulnerability in Elasticsearch that allows an authenticated user with read access to a single index to cause a denial of service. The issue arises when a search request with deeply nested payloads is processed without a depth limit, exhausting the thread stack and crashing the affected node.

Detection Guidance

Monitor for Elasticsearch nodes crashing or becoming unresponsive after processing search requests with deeply nested structures. Check Elasticsearch logs for stack overflow errors or thread exhaustion warnings.

Impact Analysis

This vulnerability can lead to system downtime as the affected Elasticsearch node terminates due to thread stack exhaustion. It may disrupt search operations and services relying on the node, causing availability issues for users with access to the impacted index.

Mitigation Strategies

Upgrade Elasticsearch to versions 8.19.20, 9.4.5, or 9.5.1 or later. If upgrading is not possible, restrict read access to sensitive indices and monitor for unusual search patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72647. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart