CVE-2026-72686

Received Received - Intake

Elasticsearch Stack Overflow Denial of Service

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation causes the thread to exhaust its stack. The resulting fatal error is not handled by the surrounding execution paths and terminates the affected node process, producing a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72686

EUVD

EUVD-2026-58250

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	*
elastic	elasticsearch	From 8.0.0 (inc) to 8.19.19 (inc)
elastic	elasticsearch	From 9.0.0 (inc) to 9.4.4 (inc)
elastic	elasticsearch	From 9.5.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-674	The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

Executive Summary

This vulnerability is a flaw in Elasticsearch where a low-privileged authenticated user can send a specially crafted request. The input validation process uses a recursive routine without bounds on input length, causing the thread to exhaust its stack. This leads to a fatal error that terminates the affected node process, resulting in a denial of service.

Detection Guidance

Detecting this vulnerability requires checking Elasticsearch versions. Run: curl -XGET 'http://localhost:9200/' | grep version.number. Affected versions are 8.0.0-8.19.19, 9.0.0-9.4.4, and 9.5.0.

Impact Analysis

The vulnerability can cause your Elasticsearch cluster to crash, leading to service disruption and downtime. Since it requires only low-privileged access, attackers could exploit it to take down nodes or entire clusters, affecting data availability and performance.

Mitigation Strategies

Upgrade Elasticsearch to versions 8.19.20, 9.4.5, or 9.5.1 immediately. No workarounds exist for users unable to upgrade. Monitor nodes for crashes or unresponsiveness.

Hi! I’m here to help you understand CVE-2026-72686. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70