CVE-2026-72636
published 2026-08-13CVE-2026-72636: Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.42%
34.1th percentile
Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of match operations performed. A search request containing a wildcard pattern with a large number of wildcard groups, evaluated against a sufficiently long name, exhausts the thread stack. Elasticsearch treats a stack overflow as an unrecoverable condition and shuts the node down, so the request terminates the affected node rather than failing gracefully.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | >= 8.0.0 < 8.19.20 | 8.19.20 |
| elastic | elasticsearch | 8.0.0 – 8.19.19 | — |
| elastic | elasticsearch | >= 9.0.0 < 9.4.5 | 9.4.5 |
| elastic | elasticsearch | 9.0.0 – 9.4.4 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Elastic Elasticsearch up to 8.19.19/9.4.4 Wildcard Matching Helper recursion (WID-SEC-2026-2841)
vuldb·2026-08-16·CVSS 6.5
CVE-2026-72636 [MEDIUM] Elastic Elasticsearch up to 8.19.19/9.4.4 Wildcard Matching Helper recursion (WID-SEC-2026-2841)
A vulnerability categorized as problematic has been discovered in Elastic Elasticsearch up to 8.19.19/9.4.4. This affects an unknown function of the component Wildcard Matching Helper. Executing a manipulation can lead to uncontrolled recursion.
This vulnerability is tracked as CVE-2026-72636. The attack can be launched remotely. No exploit exists.
It is advisable to upgrade the affected component.
GHSA
Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130).
ghsa_unreviewed·2026-08-13
CVE-2026-72636 [MEDIUM] CWE-674 Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130).
Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of match operations performed. A search request containing a wildcard pattern with a large number of wildcard groups, evaluated against a sufficiently long name, exhausts the thread stack. Elasticsearch treats a stack overflow as an unrecoverable condition and shuts the node down, so the request terminates the affected node rather than failing gracefully.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-13
Published