Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint to submit a request that causes a self-referential data structure to be created. When a specific internal component later processes that structure, the operation recurses without bound and raises a fatal error that is not handled by the surrounding execution path, terminating the affected node process and resulting in a denial of service.
Affected Versions:
- All versions from 5.0.0 up to and including 8.19.18
- All versions from 9.3.0 up to and including 9.3.7
- All versions from 9.4.0 up to and including 9.4.3
Affected Configurations:
- All configurations are affected.
Solutions and Mitigations:
The issue is resolved in version 8.19.19, 9.3.8 and 9.4.4.
For Users that Cannot Upgrade:
There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
There are no IOCs for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE ID: CVE-2026-72683
Problem Type: CWE-674 - Uncontrolled Recursion