CVE-2026-72638

MediumCVSS 6.5/10Last modified Sep 1, 2026

Description

Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth check, exhausting the thread stack and terminating the affected node.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674

Affected software

No affected versions have been published.

Timeline

Published
Aug 13, 2026
Last modified
Sep 1, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-726396.5Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived CVE-2026-72646.3A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0. Impacted is the function get_cart_items of the file /admin/ajCVE-2026-726406.5The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets it manages, and it accepts thCVE-2026-726415.4Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized modification of data via Accessing Functionality Not Properly ConstrainCVE-2026-726428.8The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a CVE-2026-726437.1Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and fallinCVE-2026-726446.5Uncaught Exception (CWE-248) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holdinCVE-2026-726456.5Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). ACVE-2026-726476.5Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An autCVE-2026-726486.5Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in Elastic Cloud on Kubernetes (ECK) can lead to informationCVE-2026-726498.8Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object InjCVE-2026-72656.3A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function Category of