Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth check, exhausting the thread stack and terminating the affected node.
Affected Versions:
- 8.x: All versions from 8.0.0 up to and including 8.19.19
- 9.x: All versions from 9.0.0 up to and including 9.4.4
Affected Configurations:
All configurations are affected. The custom analysis capability is part of index settings and is available by default; exploitation requires only the privilege to create an index.
Solutions and Mitigations:
The issue is resolved in versions 8.19.20 and 9.4.5.
For Users that Cannot Upgrade:
There are no workarounds
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE ID: CVE-2026-72638
Problem Type: CWE-674 - Uncontrolled Recursion
Impact: CAPEC-153 - Input Data Manipulation