Uncontrolled Recursion

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Uncontrolled Recursion via the wildcard matching. An attacker can cause the node to shut down by submitting a search request...

Uncontrolled Recursion

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Uncontrolled Recursion via the custom analysis definition. An attacker can exhaust the thread stack and terminate the affected nod...

Uncontrolled Recursion

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Uncontrolled Recursion via the processing of search requests with deeply nested structures in the search. An attacker can exhaust...

Uncontrolled Recursion

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Uncontrolled Recursion via the simulate pipeline API endpoint. An attacker can cause the creation of a self-referential data...

Uncontrolled Recursion

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Uncontrolled Recursion via the intervals query. An attacker can cause the exhaustion of the thread stack and terminate the node...

Uncontrolled Recursion

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Uncontrolled Recursion via the validation. An attacker can cause the affected node process to terminate unexpectedly by submitting...

CVE-2026-72683

A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate to submit a request that causes a self-referential data structure to be created. Whe...

CVE-2026-72638

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that i...

CVE-2026-72636

Uncontrolled Recursion CWE-674 in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation CAPEC-130. The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of mat...

CVE-2026-72636

CVE-2026-72636 describes an uncontrolled recursion in Elasticsearch’s wildcard matching helper (CWE-674), causing Denial of Service via stack exhaustion. Affected software includes Elasticsearch versions 8.0.0 through 8.19.19 and 9.0.0 through 9.4.4, where recursive wildcard Pattern matching coul...

CVE-2026-72636 Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service

Uncontrolled Recursion CWE-674 in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation CAPEC-130. The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of mat...

CVE-2026-72636 Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service

Uncontrolled Recursion CWE-674 in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation CAPEC-130. The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of mat...

CVE-2026-72636 Uncontrolled Recursion in Elasticsearch Wildcard Matching Leading to Denial of Service

Uncontrolled Recursion CWE-674 in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation CAPEC-130. The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of mat...

CVE-2026-72638

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that i...

CVE-2026-72638

CVE-2026-72638 : Elasticsearch contains an uncontrolled recursion (CWE-674) vulnerability that can cause a denial of service. An authenticated, low-privilege user with index-creation permissions can submit a single request containing a malformed custom analysis definition that resolves recursivel...

CVE-2026-72638 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that i...

CVE-2026-72638 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that i...

EUVD-2026-58284

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that i...

CVE-2026-72638 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Input Data Manipulation CAPEC-153. An authenticated user holding only low-privileged index creation permissions can submit a single request containing a specially crafted, malformed custom analysis definition that i...

CVE-2026-72647

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230. An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without...