Uncontrolled Recursion Vulnerability in Elasticsearch by Elastic

CVE-2026-72636

What is CVE-2026-72636?

An uncontrolled recursion flaw exists in Elasticsearch's wildcard matching helper. This issue could be exploited when a search request with a complex wildcard pattern is processed, potentially leading to excessive resource consumption and ultimately causing a denial of service. The recursive matcher does not impose limits on recursion depth or the count of match operations, resulting in thread stack exhaustion. When this occurs, Elasticsearch abruptly shuts down the affected node, ending the request without a graceful failure, which can disrupt services relying on the affected Elasticsearch instance.

References