Uncontrolled Recursion in Elasticsearch Leading to Denial of Service
Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and raises a fatal error, terminating the Elasticsearch node process and causing a denial of service for that node. An authenticated user holding only read-only privileges on a single searchable index can trigger the condition with one small search request.
Affected Versions:
- All versions from 8.19.0 up to and including 8.19.19
- All versions from 9.0.0 up to and including 9.4.4
Affected Configurations:
- All configurations are affected
Solutions and Mitigations:
The issue is resolved in version 8.19.20 and 9.4.5.
For Users that Cannot Upgrade:
- There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE ID: CVE-2026-72679
Problem Type: CWE-674 - Uncontrolled Recursion