Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without a depth limit, exhausting the thread stack and terminating the affected node.
Affected Versions:
- 8.x: All versions from 8.0.0 up to and including 8.19.19
- 9.x: All versions from 9.0.0 up to and including 9.4.4
Affected Configurations:
All configurations are affected. The retriever framework of the search API is available by default; exploitation requires only read access to a single index.
Solutions and Mitigations:
The issue is resolved in versions 8.19.20 and 9.4.5.
For Users that Cannot Upgrade:
There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE ID: CVE-2026-72647
Problem Type: CWE-674 - Uncontrolled Recursion
Impact: CAPEC-230 - Serialized Data with Nested Payloads