6.5

CVE-2026-72686: elastic elasticsearch Uncontrolled Recursion

CVSS: 6.5v3.1MediumAnalyzed
AliasesCGA-25cf-8247-75j3CGA-2gr5-5c55-jmc4CGA-3c77-9hxc-fvfx
Published 13-08-2026Last modified 13-08-2026
Open JSON

Vulnerability summary

CVE-2026-72686 is a medium (CVSS 6.5) Uncontrolled Recursion vulnerability in elastic elasticsearch. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 46.1% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.57%
0%100%
Low · +0.20 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-5WR9-M33H-3CH3

Timeline

  1. 13-08-2026
    PublishedVulnerability first disclosed.
  2. 13-08-2026
    Last modifiedVulnerability information updated.

Description

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation causes the thread to exhaust its stack. The resulting fatal error is not handled by the surrounding execution paths and terminates the affected node process, producing a denial of service.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.57%

Chance of exploitation in the next 30 days

Percentile

46%

Versus all other CVEs

30-day change

+0.20 pp

From 0.37% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.57%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard6 products
  • elasticsearch-9.2All versions (No fix recorded)
  • elasticsearch-9.3All versions (No fix recorded)
  • ruby3.2-elasticsearchAll versions (No fix recorded)
  • ruby3.3-elasticsearchAll versions (No fix recorded)
  • ruby3.4-elasticsearchAll versions (No fix recorded)
Wolfi4 products
  • ruby3.2-elasticsearchAll versions (No fix recorded)
  • ruby3.3-elasticsearchAll versions (No fix recorded)
  • ruby3.4-elasticsearchAll versions (No fix recorded)
  • ruby4.0-elasticsearchAll versions (No fix recorded)
Elastic1 product
  • elasticsearch≥ 8.0.0, ≤ 8.19.19 | ≥ 9.0.0, ≤ 9.4.4 | 9.5.0 | ≥ 8.0.0, < 8.19.20 | ≥ 9.0.0, < 9.4.5 | ≥ 9.5.0, < 9.5.1

3 vendors · 11 products

References

3 links