CVE-2026-72638
published 2026-08-13CVE-2026-72638: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only…
PriorityP336medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.42%
34.3th percentile
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth check, exhausting the thread stack and terminating the affected node.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | >= 8.0.0 < 8.19.20 | 8.19.20 |
| elastic | elasticsearch | 8.0.0 – 8.19.19 | — |
| elastic | elasticsearch | >= 9.0.0 < 9.4.5 | 9.4.5 |
| elastic | elasticsearch | 9.0.0 – 9.4.4 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Elastic Elasticsearch up to 8.19.19/9.4.4 Analysis Definition recursion (WID-SEC-2026-2841)
vuldb·2026-08-16·CVSS 6.5
CVE-2026-72638 [MEDIUM] Elastic Elasticsearch up to 8.19.19/9.4.4 Analysis Definition recursion (WID-SEC-2026-2841)
A vulnerability has been found in Elastic Elasticsearch up to 8.19.19/9.4.4 and classified as problematic. The affected element is an unknown function of the component Analysis Definition. This manipulation causes uncontrolled recursion.
This vulnerability is handled as CVE-2026-72638. The attack can be initiated remotely. There is not any exploit available.
GHSA
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153).
ghsa_unreviewed·2026-08-13
CVE-2026-72638 [MEDIUM] CWE-674 Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153).
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth check, exhausting the thread stack and terminating the affected node.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-13
Published