CVE-2026-72636

Name of the Vulnerable Software and Affected Versions Elasticsearch (affected versions not specified)

Description Uncontrolled Recursion in the wildcard matching helper can lead to a denial of service via Excessive Allocation. The matcher used to resolve wildcard patterns against names is implemented recursively without bounds on recursion depth or the total number of match operations. A search request containing a wildcard pattern with numerous wildcard groups, when evaluated against a sufficiently long name, exhausts the thread stack. Because a stack overflow is treated as an unrecoverable condition, the affected node shuts down instead of failing gracefully.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.