1. Home
  2. CVE Database
  3. CVE-2026-72686
MEDIUM · 6.5

CVE-2026-72686

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recurs...

Vulnerability Description

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recursive routine and applies no bound to the length of the value being validated, so the validation causes the thread to exhaust its stack. The resulting fatal error is not handled by the surrounding execution paths and terminates the affected node process, producing a denial of service.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH

Affected Products

VendorProductVersions
ElasticElasticsearch>= 8.0.0, < 8.19.20

Related Weaknesses (CWE)

CWE-674

References

FAQ

What is CVE-2026-72686?

CVE-2026-72686 is a vulnerability with a CVSS score of 6.5 (MEDIUM). A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A specific internal component validates the input using a recurs...

How severe is CVE-2026-72686?

CVE-2026-72686 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-72686?

Check the references section above for vendor advisories and patch information. Affected products include: Elastic Elasticsearch.