CVE-2026-72679: Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and raises a fatal error, terminating the Elasticsearch node process and causing a denial of service for that node. An authenticated user holding only read-only privileges on a single searchable index can trigger the condition with one small search request.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72679?
The severity of CVE-2026-72679 is medium with a CVSS score of 6.5.
How does CVE-2026-72679 affect Elasticsearch?
CVE-2026-72679 can lead to a denial of service by exhausting the thread stack through uncontrolled recursion in user-supplied patterns.
What are the potential impacts of CVE-2026-72679?
The impact of CVE-2026-72679 includes terminating the Elasticsearch node process, which can disrupt service availability.
How can I mitigate CVE-2026-72679?
Mitigation for CVE-2026-72679 involves applying patches from the Elasticsearch security update to prevent unbounded recursion.
Which software versions are affected by CVE-2026-72679?
CVE-2026-72679 affects certain versions of Elastic Elasticsearch, specifically those that allow unbounded nesting in intervals queries.