CVE-2026-72638: Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth check, exhausting the thread stack and terminating the affected node.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72638?
The severity of CVE-2026-72638 is classified as medium with a score of 6.5.
How do I fix CVE-2026-72638?
To fix CVE-2026-72638, update your Elasticsearch installation to the latest version that addresses this vulnerability.
What is CVE-2026-72638?
CVE-2026-72638 describes an uncontrolled recursion vulnerability in Elasticsearch that can lead to denial of service.
Who is affected by CVE-2026-72638?
CVE-2026-72638 affects authenticated users with low-privileged index creation permissions in Elasticsearch.
What kind of attack does CVE-2026-72638 enable?
CVE-2026-72638 enables denial of service attacks via manipulation of input data leading to uncontrolled recursion.