CVE-2026-72647
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Uncontrolled recursion in Elasticsearch can lead to denial of service. An authenticated user with read-only privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without a depth limit, exhausting the thread stack and terminating the affected node.
Risk Assessment
An attacker with minimal privileges (read-only on one index) can crash an Elasticsearch node, potentially affecting the availability of the entire cluster and dependent services.
Recommendation
Install vendor security patches and implement depth limits for search queries. Restrict query execution privileges and monitor for unusual requests.
Original NVD description (English source)
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without a depth limit, exhausting the thread stack and terminating the affected node.