CVE-2026-72636 in Elasticsearch
Summary
by MITRE • 08/13/2026
Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of match operations performed. A search request containing a wildcard pattern with a large number of wildcard groups, evaluated against a sufficiently long name, exhausts the thread stack. Elasticsearch treats a stack overflow as an unrecoverable condition and shuts the node down, so the request terminates the affected node rather than failing gracefully.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability described represents a critical denial of service weakness in Elasticsearch systems where uncontrolled recursion in wildcard pattern matching creates a pathway for attackers to systematically crash cluster nodes. This issue manifests through the Elasticsearch wildcard matching helper functionality which employs recursive algorithms without implementing any safeguards against excessive recursion depth or total operation counts. The recursive nature of the implementation means that each wildcard pattern evaluation can potentially trigger multiple nested function calls, creating an exponential growth in computational overhead that rapidly consumes available stack memory resources.
The technical flaw specifically resides in the lack of recursion depth limits and operational constraints within the wildcard matching component, which directly maps to CWE-674 classification for uncontrolled recursion. When a maliciously crafted search request contains wildcard patterns with numerous wildcard groups applied against sufficiently long target strings, the recursive evaluation process can quickly exhaust the thread stack space allocated to each processing thread. This particular implementation pattern violates fundamental security principles by not incorporating defensive programming practices such as maximum recursion depth checks or iterative alternatives that could prevent unbounded resource consumption.
The operational impact of this vulnerability extends beyond simple service disruption as it creates a systematic approach for attackers to target Elasticsearch nodes and cause complete node termination rather than graceful failure handling. When the stack overflow condition occurs, Elasticsearch's runtime environment treats this as an unrecoverable fault condition, triggering automatic node shutdown procedures that can cascade through cluster configurations and potentially compromise entire distributed search environments. This behavior aligns with CAPEC-130 category for excessive allocation attacks where resource exhaustion leads to system-wide service degradation rather than localized failures.
The mitigation strategies for this vulnerability require immediate implementation of recursion depth limiting mechanisms within the wildcard matching components, combined with operational monitoring to detect anomalous pattern matching behaviors that might indicate attempted exploitation. Organizations should implement rate limiting controls on wildcard query processing and establish memory allocation boundaries that prevent individual requests from consuming excessive stack space. Additionally, migrating to iterative pattern matching algorithms or implementing bounded recursion approaches would provide more robust protection against similar classes of vulnerabilities while maintaining the core functionality required for legitimate wildcard search operations within Elasticsearch environments.