CVE-2026-72679

Received Received - Intake

Stack Overflow in Elasticsearch Intervals Query

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and raises a fatal error, terminating the Elasticsearch node process and causing a denial of service for that node. An authenticated user holding only read-only privileges on a single searchable index can trigger the condition with one small search request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72679

EUVD

EUVD-2026-58253

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	*
elastic	elasticsearch	From 8.19.0 (inc) to 8.19.19 (inc)
elastic	elasticsearch	From 9.0.0 (inc) to 9.4.4 (inc)
elastic	elasticsearch	8.19.20
elastic	elasticsearch	9.4.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability in Elasticsearch involves uncontrolled recursion when processing deeply nested user-supplied patterns in an intervals query. The system fails to apply input length restrictions, leading to unbounded recursion that exhausts the thread stack. This causes a fatal error, terminating the Elasticsearch node process and resulting in a denial of service.

Detection Guidance

Check Elasticsearch version with: curl -XGET 'http://localhost:9200'. Affected versions are 8.19.0-8.19.19 and 9.0.0-9.4.4. Monitor for node crashes or fatal errors in logs.

Impact Analysis

An authenticated user with read-only access to a single index can trigger this condition with a single search request. The impact includes node process termination, denial of service for that node, and potential disruption of search functionality. Availability of the Elasticsearch cluster may be affected.

Compliance Impact

This vulnerability primarily impacts availability, which could lead to service disruptions. While it does not directly affect data confidentiality or integrity, prolonged downtime may impact compliance with availability requirements in standards like GDPR or HIPAA. No specific compliance violations are mentioned in the provided context.

Mitigation Strategies

Upgrade Elasticsearch to version 8.19.20 or 9.4.5 immediately. If unable to upgrade, restrict access to searchable indices and disable intervals query usage as a temporary measure.

Hi! I’m here to help you understand CVE-2026-72679. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70