Denial of Service Vulnerability in Elasticsearch by Elastic

CVE-2026-72647

What is CVE-2026-72647?

A potential denial of service vulnerability exists in Elasticsearch, where an authenticated user with only read access can submit a specially crafted search request. This request can contain deeply nested payloads processed without depth constraints, resulting in uncontrolled recursion. This flaw can exhaust the thread stack, causing the affected Elasticsearch node to terminate and become unavailable, thereby impacting service stability and availability.

References