CVE-2026-72685: Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service
A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the availability of indexing operations on the affected node.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72685?
The severity of CVE-2026-72685 is rated as medium with a score of 4.3.
How do I fix CVE-2026-72685?
To fix CVE-2026-72685, upgrade Elasticsearch to the latest version that has addressed this vulnerability.
What impact does CVE-2026-72685 have on my system?
CVE-2026-72685 can lead to a denial of service by consuming worker threads, resulting in degraded performance of Elasticsearch.
Who is affected by CVE-2026-72685?
CVE-2026-72685 affects low-privileged authenticated users who can index documents in Elasticsearch.
What is the nature of the vulnerability in CVE-2026-72685?
The vulnerability in CVE-2026-72685 involves inefficient algorithmic complexity that allows crafted input to monopolize processing resources.