CVE-2026-72683

Analyzed Analyzed - Analysis Complete

Elasticsearch Denial of Service via Self-Referential Pipeline

Publication date: 2026-08-13

Last updated on: 2026-09-01

Assigner: Elastic

Description

A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate) to submit a request that causes a self-referential data structure to be created. When a specific internal component later processes that structure, the operation recurses without bound and raises a fatal error that is not handled by the surrounding execution path, terminating the affected node process and resulting in a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-09-01

Generated

2026-09-03

AI Q&A

2026-08-14

EPSS Evaluated

2026-09-02

NVD

CVE-2026-72683

EUVD

EUVD-2026-58247

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	From 9.4.0 (inc) to 9.4.4 (exc)
elastic	elasticsearch	From 9.3.0 (inc) to 9.3.8 (exc)
elastic	elasticsearch	From 5.0.0 (inc) to 8.19.19 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial of service flaw in Elasticsearch. An authenticated user with specific privileges can exploit the simulate pipeline API to create a self-referential data structure. When processed internally, this causes unbounded recursion, leading to a fatal error that crashes the affected node.

Detection Guidance

To detect this vulnerability, check if your Elasticsearch version is within the affected range (5.0.0-8.19.18, 9.3.0-9.3.7, 9.4.0-9.4.3). Run the command: curl -XGET 'http://localhost:9200/' to check the version. If you have access to the simulate pipeline API, attempt to send a request with a self-referential data structure to observe abnormal behavior or crashes.

Monitor logs for node crashes or fatal errors after processing pipeline simulation requests. Check Elasticsearch logs in /var/log/elasticsearch/ for recursion-related errors.

Impact Analysis

The impact includes node crashes, service disruption, and potential downtime for Elasticsearch clusters. Affected versions are 5.0.0 through 8.19.18, 9.3.0 through 9.3.7, and 9.4.0 through 9.4.3. Upgrading to fixed versions mitigates the risk.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing service disruptions due to denial of service. GDPR requires maintaining data availability, and HIPAA mandates continuous access to protected health information. A crash in Elasticsearch nodes could lead to unauthorized data access or loss of critical records, violating these regulations.

Mitigation Strategies

Upgrade Elasticsearch to the fixed versions: 8.19.19, 9.3.8, or 9.4.4. If upgrading is not immediately possible, restrict access to the simulate pipeline API endpoint to trusted users only. Disable or limit API privileges for users who do not require pipeline simulation access.

Hi! I’m here to help you understand CVE-2026-72683. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70