← Back

CVE-2026-72685

nvd nist
Published: Aug 13, 2026Modified: Sep 1, 2026

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Exploitability: 2.8 / Impact: 1.4
Source: security@elastic.co (Secondary)

Description

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the availability of indexing operations on the affected node.

Affected (2)

Elastic
1 product
Elasticsearch
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Elastic
Elasticsearch
From 8.0.0 to 8.19.20
Elasticsearch
From 9.0.0 to 9.4.5

Related CWEs

CWE-407
Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

References (1)

Source: security@elastic.co
Vendor Advisory

Timeline

No history available yet.