CVE-2026-72683 PUBLISHED

Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Assigner: elastic
Reserved: 10.08.2026 Published: 13.08.2026 Updated: 13.08.2026

A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate) to submit a request that causes a self-referential data structure to be created. When a specific internal component later processes that structure, the operation recurses without bound and raises a fatal error that is not handled by the surrounding execution path, terminating the affected node process and resulting in a denial of service.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 6.5

Product Status

Vendor Elastic
Product Elasticsearch
Versions Default: unaffected
  • affected from 5.0.0 to 8.19.18 (incl.)
  • affected from 9.3.0 to 9.3.7 (incl.)
  • affected from 9.4.0 to 9.4.3 (incl.)

References

Problem Types

  • CWE-674 Uncontrolled Recursion CWE