CVE-2026-72647: Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without a depth limit, exhausting the thread stack and terminating the affected node.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72647?
The severity of CVE-2026-72647 is rated as medium with a score of 6.5.
How do I fix CVE-2026-72647?
To fix CVE-2026-72647, upgrade to the latest version of Elasticsearch that addresses this vulnerability.
What type of attack does CVE-2026-72647 enable?
CVE-2026-72647 allows an authenticated user to cause a denial of service via a specially crafted search request.
Who is affected by CVE-2026-72647?
CVE-2026-72647 affects authenticated users with read privileges on a single Elasticsearch index.
What underlying issue is present in CVE-2026-72647?
CVE-2026-72647 involves uncontrolled recursion leading to denial of service through nested payloads.