CVE-2026-72679 in Elasticsearch
Summary
by MITRE • 08/13/2026
Elasticsearch does not apply its configurable input length restriction to a user-supplied pattern accepted by an intervals query. Compiling a deeply nested pattern drives unbounded recursion that exhausts the thread stack and raises a fatal error, terminating the Elasticsearch node process and causing a denial of service for that node. An authenticated user holding only read-only privileges on a single searchable index can trigger the condition with one small search request.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a critical denial of service weakness in elasticsearch systems where input validation fails to properly constrain user-supplied patterns within intervals queries. The flaw manifests when elasticsearch processes deeply nested regular expression patterns without enforcing configured input length restrictions, allowing maliciously crafted patterns to trigger unbounded recursion during compilation phases. This recursive processing consumes excessive thread stack memory resources until the operating system terminates the process due to stack exhaustion.
The technical implementation involves the elasticsearch query processing engine failing to validate pattern complexity against established security boundaries when handling intervals queries that accept user-provided regular expressions. This weakness directly maps to common software security flaws identified in cwe-674, which describes uncontrolled recursion as a vulnerability where recursive functions lack proper termination conditions or input constraints. The vulnerability operates at the application layer and can be exploited through the standard search api endpoints, making it particularly dangerous as it requires minimal privileges to execute.
An authenticated user with read-only access to a single searchable index can exploit this weakness by submitting a specifically crafted search request containing a deeply nested pattern structure that causes the elasticsearch node to enter infinite recursion. The attack vector requires no special administrative privileges or elevated permissions beyond basic read access, making it exceptionally dangerous in multi-tenant environments where users may have limited access but still pose significant threat potential. The vulnerability affects the core processing engine rather than specific plugins or modules, ensuring broad impact across affected elasticsearch deployments.
The operational impact of this vulnerability extends beyond simple service interruption to encompass complete node termination and potential cascading failures within distributed elasticsearch clusters. When a single node crashes due to stack exhaustion, it can trigger cluster rebalancing operations and potentially affect data availability for legitimate users. The denial of service condition occurs rapidly with minimal resource consumption from the attacker's perspective, making it difficult to distinguish from legitimate high-computation queries and complicating detection efforts within network monitoring systems.
Mitigation strategies should focus on implementing comprehensive input validation controls that limit pattern nesting depth and overall complexity before processing begins. Organizations should configure elasticsearch to enforce strict limits on regular expression pattern lengths and recursion depths through configuration parameters such as max_clause_count or similar constraints. Additionally, implementing rate limiting and resource monitoring for search operations can help detect abnormal computational patterns that may indicate exploitation attempts. Security teams should consider deploying intrusion detection systems capable of identifying suspicious search query patterns and establish automated alerting mechanisms for unusual processing behavior within elasticsearch clusters. The vulnerability also highlights the importance of regular security assessments and code reviews focusing on recursive processing functions to identify similar patterns across other components within the elasticsearch ecosystem.