CVE-2026-72685
Received Received - Intake

Denial of Service in Elasticsearch

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description
A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the availability of indexing operations on the affected node.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-14
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-72685
EUVD
EUVD-2026-58249

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
elastic elasticsearch *
elastic elasticsearch From 8.0.0 (inc) to 8.19.19 (inc)
elastic elasticsearch From 9.0.0 (inc) to 9.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Elasticsearch allows a low-privileged authenticated user to submit a small document with crafted input. The processing of this document consumes a worker thread from a limited pool for an excessive amount of time, reducing the availability of indexing operations on the affected node.

Detection Guidance

Detecting this vulnerability requires monitoring Elasticsearch for unusual indexing delays or thread exhaustion. Check Elasticsearch logs for slow indexing operations or worker thread timeouts. Use Elasticsearch APIs like _nodes/stats to monitor thread pool usage and _cluster/health to detect degraded performance.

Impact Analysis

This vulnerability can degrade the performance of Elasticsearch by occupying worker threads, leading to slower or failed indexing operations. It may cause system unavailability or reduced efficiency for users relying on Elasticsearch for document processing.

Compliance Impact

This vulnerability primarily impacts availability by degrading indexing performance through resource exhaustion. While not directly violating GDPR or HIPAA, it could lead to system unavailability, potentially causing delays in processing personal or health data, which may violate time-sensitive compliance requirements for data access or processing.

Mitigation Strategies

Apply the latest security patches or updates provided by Elasticsearch to fix the flaw. Limit user permissions to reduce the risk of exploitation by low-privileged users. Monitor indexing performance and resource usage for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72685. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart