CVE-2026-72686

Name of the Vulnerable Software and Affected Versions Elasticsearch (affected versions not specified)

Description A flaw allows a low-privileged authenticated user to trigger a denial of service by submitting a single request with crafted input. An internal component validates this input using a recursive routine without bounding the length of the value. This causes the thread to exhaust its stack, leading to a fatal error that terminates the affected node process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.