CVE-2026-72638
Medium · 6.5CVSS
6.5
EPSS
—
Published
Aug 13, 2026
CISA due date
—
The record
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that is resolved recursively without a cycle or depth check, exhausting the thread stack and terminating the affected node.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-92822 A flaw was found in libmodulemd. CWE-674
- CVE-2026-112895 Pillow is a Python imaging library. CWE-674
- CVE-2026-100354 kin-openapi is a Go project for handling OpenAPI files. CWE-674
- CVE-2026-109267 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL… CWE-674
- CVE-2026-109264 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in… CWE-674
- CVE-2026-107678 FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in… CWE-674
- CVE-2026-107208 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-674
- CVE-2026-106572 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-674