Uncontrolled Recursion in Elasticsearch Leading to Denial of Service (CVE-2026-72647)

This vulnerability in Elasticsearch arises from uncontrolled recursion (CWE-674) when processing serialized data containing deeply nested payloads (CAPEC-230). An authenticated user with only read access on a single index can craft a search request with a deeply nested structure that Elasticsearch processes without enforcing a recursion depth limit. This leads to exhaustion of the thread stack, causing the affected Elasticsearch node to terminate and resulting in a denial of service condition. The vulnerability affects versions >=8.0.0 <8.19.20 and >=9.0.0 <9.4.5. No known exploits in the wild have been reported. A patch is available to remediate this issue.

Successful exploitation allows an authenticated user with read privileges on a single index to cause a denial of service by crashing the Elasticsearch node. This disrupts availability of the affected Elasticsearch instance. There is no indication of privilege escalation or data confidentiality/integrity impact.

A patch is available for this vulnerability. Users should upgrade affected Elasticsearch versions to 8.19.20 or later, or 9.4.5 or later, where the issue is fixed. No additional mitigation steps are indicated by the vendor advisory.