Vulnerability Details CVE-2026-72683
A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ingest-simulate) to submit a request that causes a self-referential data structure to be created. When a specific internal component later processes that structure, the operation recurses without bound and raises a fatal error that is not handled by the surrounding execution path, terminating the affected node process and resulting in a denial of service.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 28.9%
CVSS Severity
CVSS v3 Score 6.5
References
Products affected by CVE-2026-72683
-
cpe:2.3:a:elastic:elasticsearch:9.3.0
-
cpe:2.3:a:elastic:elasticsearch:9.3.1
-
cpe:2.3:a:elastic:elasticsearch:9.3.2
-
cpe:2.3:a:elastic:elasticsearch:9.3.3
-
cpe:2.3:a:elastic:elasticsearch:9.3.4
-
cpe:2.3:a:elastic:elasticsearch:9.3.5
-
cpe:2.3:a:elastic:elasticsearch:9.3.6
-
cpe:2.3:a:elastic:elasticsearch:9.3.7
-
cpe:2.3:a:elastic:elasticsearch:9.4.0
-
cpe:2.3:a:elastic:elasticsearch:9.4.1
-
cpe:2.3:a:elastic:elasticsearch:9.4.2
-
cpe:2.3:a:elastic:elasticsearch:9.4.3