CVE-2026-72638

Executive Summary

CVE-2026-72638 is a high-severity (CVSS 6.5) denial-of-service vulnerability affecting Elasticsearch, rooted in an uncontrolled recursion flaw (CWE-674). An authenticated attacker possessing only low-privileged index creation permissions can submit a single crafted request containing a malformed custom analysis definition. The malformed definition is resolved recursively without cycle or depth checks, exhausting the thread stack and terminating the affected Elasticsearch node. This results in a node-level denial of service (availability impact is High; confidentiality and integrity are unaffected). As of the assessment date, the vulnerability is unpatched with no vendor fix, workaround, or public exploit code available.

Technical Analysis

Vulnerability Class: Uncontrolled Recursion (CWE-674)

The vulnerability resides in Elasticsearch's custom analysis definition resolution mechanism. Custom analysis definitions in Elasticsearch (e.g., custom analyzers, tokenizers, char filters) are user-defined components that may reference other components. When a specially crafted, malformed custom analysis definition is submitted — likely containing self-referential or mutually recursive elements — the resolution process is triggered on a single request.

Attack Mechanism:

The NVD description highlights two critical missing safeguards:

1. Missing cycle detection: The recursive resolver does not track which definitions are currently being resolved. A definition that directly or transitively references itself (e.g., Analyzer A uses Tokenizer B, which references Analyzer A) will cause the resolver to re-enter the same code path indefinitely. Without a "visited set" or similar cycle-tracking mechanism, the recursion never terminates naturally.

2. Missing depth limit: No maximum recursion depth is enforced. Even non-cyclic but deeply nested definitions could trigger the same failure, though the cycle-based approach is the more efficient attack.

Failure Mode — Stack Overflow:

A single request triggering unbounded recursion causes the Java Virtual Machine (JVM) thread stack to overflow. In Elasticsearch's architecture, many node-level operations share a common thread pool. When the thread processing the malicious request exhausts its stack, a StackOverflowError is thrown. This is an Error (not an Exception) in Java and is typically not catchable. The affected node — not just the processing thread — terminates. Because no data corruption or privilege escalation is possible, the impact is strictly availability-focused.

Attack Surface:

The attack requires only the create_index (or equivalent) privilege, considered a low-privileged operation. Any authenticated user who can create or update an index — a common permission granted to application service accounts and data ingestion pipelines — is a viable attack vector. No special network access beyond reaching the Elasticsearch HTTP API is required (network attack vector: AV:N). The attack can be performed with a single HTTP request and requires no user interaction (UI:N) and no special conditions beyond authentication (PR:L).

Exploitation Scenarios

Note: No public PoC or exploit code is currently available. The attack chain below is inferred from the vulnerability class and NVD description. Specific function names, endpoints, and payload structures are intentionally NOT fabricated.

Attack Chain Steps:

1. Reconnaissance / Target Identification: An authenticated attacker identifies Elasticsearch clusters accessible over the network with the HTTP API exposed. The attacker validates (1) that their credentials hold index creation/update permissions, and (2) that the cluster permits submission of custom analysis definitions. A simple GET /_cluster/health request confirms node availability and that an attack from a single request can cause a visible impact.

2. Trigger of the Vulnerability Class: The attacker submits a request containing a custom analysis definition designed to create a recursive resolution cycle. Because the attacker only needs index creation rights (the lowest privilege tier for write operations in Elasticsearch), no administrative or elevated access is required. The request is crafted at the vulnerability-class level: the custom analysis definition includes a reference chain that loops back on itself (direct or transitive self-reference), or a deeply nested non-cyclic chain exceeding JVM stack limits.

3. Payload / Execution Method: At the class level, the attacker submits a single HTTP PUT request to create an index (with mapping settings containing custom analysis definitions) — this is the standard API path any index-creating user may use. The "payload" is the malformed custom analysis definition itself. Because no cycle check or depth limit exists, the definition resolution logic enters unbounded recursion. No remote code execution, data exfiltration, or credential extraction requires to be considered — the payload is static and requires only one request. The recursion exhausts the JVM thread stack for the processing thread.

4. Impact / Post-Exploitation: The StackOverflowError terminates the affected Elasticsearch node. Depending on cluster configuration: with a single node, the entire cluster becomes unavailable. With a multi-node cluster, one node goes down — causing a redistribution of shards, potential data availability degradation, and if the node is a coordinating-only node, ingestion path interruption. The attacker can repeat the process for each node in the cluster, achieving cluster-wide denial of service. Since no authentication bypass occurs, no further lateral movement or data access is gained. The impact is pure availability: High (CVSS A:H), with no confidentiality or integrity loss (C:N/I:N).

Impact Assessment

Business Impact:

• Service interruption: Elasticsearch nodes terminating cause search, ingestion, and analytics outages.
• Cascading failures: In multi-node clusters, a terminating node triggers shard reallocation, increased load on remaining nodes, and possible red/yellow cluster health states.
• Low-friction exploitation: Only index-creation privileges required — this is commonly granted to application accounts and CI/CD pipelines, widely present in enterprise environments.
• No patch available: As confidence is 0/4, all affected clusters remain exposed indefinitely until a fix is released.
• Compliance: Public-facing search or data platforms suffer extended downtime, potentially violating uptime SLAs.

Blast Radius: All versions of Elasticsearch that support custom analysis definitions (virtually all recent versions since custom analyzers became available) are potentially affected. Absence of a version range in the advisory implies broad impact across the product line. Exact affected version list is not provided in the CVE data; customers should treat all versions as vulnerable until a patch is released.

Detection Guidance

The following detection rules target the attack at the network/application layer — a single authenticated request containing a recursive custom analysis definition. Because no public PoC exists, rules focus on anomaly signatures: single-request failures, stack overflow logs, and unusual custom analysis definition payloads.

Sigma Rule

title: Elasticsearch Recursive Analysis Definition DoS Attempt
id: 9f4e2b11-0ab2-4f6c-9b50-2e7f3d1c8a40
status: experimental
description: Detects single-request submission of custom analysis definitions that trigger uncontrolled recursion (CVE-2026-72638) leading to thread stack exhaustion.
author: Valtersit Threat Intelligence
date: 2026/02/02
logsource:
    category: application
    product: elasticsearch
detection:
    selection_stackoverflow:
        message|contains:
            - 'StackOverflowError'
            - 'java.lang.StackOverflowError'
    selection_pool_exit:
        message|contains:
            - 'thread pool is exhausted'
            - 'ThreadPoolExecutor'
    selection_analysis:
        message|contains:
            - 'custom analysis'
            - 'analysis definition'
            - 'uncontrolled recursion'
    condition: (selection_stackoverflow or selection_pool_exit) and selection_analysis
    timeframe: 10s
level: high
falsepositives:
    - Legitimate malformed analysis definitions causing accidental recursion (rare)
    - java.lang.StackOverflowError from other code paths (e.g., deep data structures)
fields:
    - host
    - source.ip
    - user.name
    - message
tags:
    - attack.t1498
    - cve.2026.72638
    - cwe.674

YARA Rule

rule Elasticsearch_Recursion_Dos_CVE_2026_72638
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects network traffic or log artifacts indicating recursive custom analysis definition attempts against Elasticsearch"
        cve = "CVE-2026-72638"
        cwe = "CWE-674"
        date = "2026-02-02"
        score = "60"

    strings:
        $a = "analysis" ascii nocase
        $b = "tokenizer" ascii nocase
        $c = "char_filter" ascii nocase
        $d = "filter" ascii nocase
        $e = "StackOverflowError" ascii
        $f = "uncontrolled recursion" ascii
        $g = "RecursionError" ascii
        $h = "referenced by itself" ascii

    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0D0A or uint16(0) == 0x2026 or
        any of them
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Elasticsearch CVE-2026-72638 Recursive Analysis Definition DoS Attempt"; flow:established,to_server; content:"POST"; http_method; content:"_index"; http_uri; nocase; content:"analysis"; http_client_body; nocase; content:"tokenizer"; http_client_body; nocase; distance:0; within:50; content:"char_filter"; http_client_body; nocase; distance:0; within:50; content:"filter"; http_client_body; nocase; distance:0; within:50; content:"{"; http_client_body; depth:10; offset:0; threshold:type both, track by_src, count 3, seconds 60; reference:cve,2026-72638; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-72638; classtype:attempted-dos; sid:2026072638; rev:1; priority:1;)

Note: This rule detects the general pattern of HTTP POST/PUT requests that include analysis/tokenizer/char_filter components. Because legitimate custom analysis creation appears identical at the protocol level, consider enabling this rule with a threshold (as configured) to limit false positives to repeated attempts.

Elastic Detection

apiVersion: v1
kind: eql
metadata:
    name: CVE-2026-72638 Elasticsearch Recursion DoS
rule:
    query: |
        sequence by agent.id, source.ip with maxspan=10s
            [network where event.category == "network" and destination.port == 9200 and network.protocol == "http"]
            [process where event.category == "process" and process.name == "java"
               and process.args : "*elasticsearch*"
               and (message : "*StackOverflowError*" or message : "*thread pool is exhausted*")]
    description: "Detects a network connection to Elasticsearch followed by a JVM StackOverflowError or thread pool exhaustion within 10 seconds, indicating a possible CVE-2026-72638 exploitation attempt."
    severity: high
    tags:
        - CVE-2026-72638
        - CWE-674
        - DoS
    risk_score: 65

Splunk SPL Query

index=elasticsearch (source="*elasticsearch*" OR sourcetype="*elasticsearch*")
| where match(_raw, "(?i)StackOverflowError") OR match(_raw, "(?i)uncontrolled recursion") OR match(_raw, "(?i)thread pool is exhausted")
| eval is_analysis_event=if(match(_raw, "(?i)analysis"), 1, 0)
| where is_analysis_event=1
| stats count by host, source_ip, user, _time
| where count >= 1
| sort - _time
| table _time, host, source_ip, user, count
| convert ctime(_time)

Wazuh OSSEC Rule

<group name="elasticsearch,">
    <rule id="100726" level="12">
        <decoded_as>elasticsearch</decoded_as>
        <match>StackOverflowError|uncontrolled recursion|thread pool is exhausted</match>
        <description>Elasticsearch: Possible CVE-2026-72638 recursion-based DoS (thread stack exhaustion)</description>
        <group>denial_of_service,cve-2026-72638,cwe-674,</group>
        <mitre>
            <id>T1498</id>
        </mitre>
        <options>no_full_log</options>
        <var name="alert_timeframe">10</var>
        <frequency>1</frequency>
    </rule>

    <rule id="100727" level="6">
        <decoded_as>elasticsearch</decoded_as>
        <match>analysis</match>
        <description>Elasticsearch: custom analysis definition submission detected (potential CVE-2026-72638 precursor)</description>
        <group>cve-2026-72638,</group>
        <mitre>
            <id>T1498</id>
        </mitre>
        <options>no_full_log</options>
    </rule>
</group>

Note: Wazuh's Elasticsearch decoder must be enabled to parse Elasticsearch logs. The second rule (100727) is informational (level 6) and correlates custom analysis submissions with subsequent stack overflow logs.

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source. No vendor advisory, no patch, no workaround released.)

Immediate Mitigations (until patch available):

1. Restrict index creation privileges: Audit and narrow create_index (or index write) permissions. Grant this privilege only to trusted service accounts that require it. Where possible, use role-based access control (RBAC) to restrict custom analysis definition creation to administrative users only.

2. Network segmentation / input validation: Place Elasticsearch behind an API gateway or reverse proxy that can inspect and optionally block requests containing custom analysis definitions. If custom analyzers are not required, block requests that create or update index settings with analysis components.

3. Cluster-level resilience: Ensure at least 2–3 nodes are configured for any critical cluster so that a single node termination does not cause total outage. Configure shard allocation awareness to distribute load across nodes during recovery.

4. Enable JVM -XX:StackOverflowError handling and monitor health: Configure process-level monitors (e.g., Prometheus up metric, automated restart) so affected nodes restart automatically.

5. Log monitoring: Activate the detection rules above to receive early warning of exploitation attempts.

Patch / Upgrade Steps:

1. Monitor vendor advisory channels: Subscribe to Elastic Security Advisories (elastic.co/security-advisories) for the release of a patch addressing CVE-2026-72638.

2. Upgrade path: Once released, upgrade all Elasticsearch nodes to the patched version. Use the rolling upgrade procedure for multi-node clusters to minimize downtime. Pay special attention to minor/major version compatibility with the client libraries.

3. Validate post-patch: After upgrade, verify that a previously-affected version's custom analysis definitions still resolve correctly, and confirm no regression in analysis features.

Long-term Hardening:

1. Principle of least privilege: Apply the RBAC model strictly — index creation should be a controlled action. Review all roles quarterly.

2. Network-level protection: Run Elasticsearch only on internal networks, never exposed to the internet. Place a Web Application Firewall (WAF) if external access is unavoidable.

3. Perform recursive-source-code audits: Because CWE-674 arises from missing cycle/depth checks, review Elasticsearch for similar unresolved-recursion patterns in other user-controllable definition types (e.g., search templates, pipeline processors, ingest processors).

4. Adopt containerized deployments with memory/thread limits so a single-node stack overflow cannot destabilize the host OS.

5. Establish a do-not-call policy: For clusters where custom analysis is unnecessary, disable the feature via configuration to reduce attack surface.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72638 (Official NVD record; CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
2. MITRE CWE-674: https://cwe.mitre.org/data/definitions/674.html (Uncontrolled Recursion definition)
3. CAPEC-153: https://capec.mitre.org/data/definitions/153.html (Input Data Manipulation — attack pattern)
4. Elastic Security Advisories (Monitoring Site): https://www.elastic.co/security-advisories (Watch for official advisory when released)
5. MITRE ATT&CK T1498: https://attack.mitre.org/techniques/T1498/ (Network Denial of Service — tactic mapping)

Exploit-in-the-Wild Status: No known public exploits, privilege escalation chains, or threat actor campaigns are associated with this CVE at the time of writing. PoC/exploit code status is unknown in private circles; EPSS score is not yet assigned by FIRST.org. CISA KEV: not listed — the vulnerability is not confirmed as exploited in the wild.