Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service (CVE-2026-72685)
CVE-2026-72685 is a medium severity vulnerability in Elasticsearch where a low-privileged authenticated user who can index documents can submit a crafted small document that causes a worker thread to be occupied for a disproportionate amount of time. This leads to degraded availability of indexing operations on the affected node.
AI Analysis
Technical Summary
This vulnerability in Elasticsearch allows an authenticated user with document indexing permissions to submit a specially crafted small document containing user-supplied input. Processing this document causes a worker thread from a bounded thread pool to be occupied excessively, resulting in degraded availability of indexing operations on the affected Elasticsearch node. The flaw is due to inefficient algorithmic complexity in handling the input. No CVSS score is provided, but the impact is rated medium severity. The affected versions are Elasticsearch versions from 8.0.0 up to but not including 8.19.20 and from 9.0.0 up to but not including 9.4.5. A patch is available for this vulnerability.
Potential Impact
An attacker with low privileges who can index documents can degrade the availability of indexing operations on the affected Elasticsearch node by submitting a crafted document that consumes excessive worker thread time. This can lead to denial of service conditions affecting indexing performance and node availability.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade Elasticsearch to versions 8.19.20 or later, or 9.4.5 or later, where this issue is fixed. Since this is not a cloud service, remediation requires applying the patch or upgrade on affected installations.
Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service (CVE-2026-72685)
Description
CVE-2026-72685 is a medium severity vulnerability in Elasticsearch where a low-privileged authenticated user who can index documents can submit a crafted small document that causes a worker thread to be occupied for a disproportionate amount of time. This leads to degraded availability of indexing operations on the affected node.
Affected software
pkg:bitnami/elasticsearchRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Elasticsearch allows an authenticated user with document indexing permissions to submit a specially crafted small document containing user-supplied input. Processing this document causes a worker thread from a bounded thread pool to be occupied excessively, resulting in degraded availability of indexing operations on the affected Elasticsearch node. The flaw is due to inefficient algorithmic complexity in handling the input. No CVSS score is provided, but the impact is rated medium severity. The affected versions are Elasticsearch versions from 8.0.0 up to but not including 8.19.20 and from 9.0.0 up to but not including 9.4.5. A patch is available for this vulnerability.
Potential Impact
An attacker with low privileges who can index documents can degrade the availability of indexing operations on the affected Elasticsearch node by submitting a crafted document that consumes excessive worker thread time. This can lead to denial of service conditions affecting indexing performance and node availability.
Mitigation Recommendations
A patch is available for this vulnerability. Users should upgrade Elasticsearch to versions 8.19.20 or later, or 9.4.5 or later, where this issue is fixed. Since this is not a cloud service, remediation requires applying the patch or upgrade on affected installations.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-elasticsearch-2026-72685
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2026-72685"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Medium
- Cvss Version
- null
Threat ID: 6a85b4b1acd9273b49251096
Added to database: 08/19/2026, 13:50:41 UTC
Last enriched: 08/19/2026, 14:10:04 UTC
Last updated: 08/19/2026, 17:52:00 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.