Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-72647

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
elastic

Description

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without a depth limit, exhausting the thread stack and terminating the affected node.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Elastic Elasticsearch

Default version status: unaffected

  • 8.0.0 to ≤ 8.19.19affected
  • 9.0.0 to ≤ 9.4.4affected

References