CVE-2026-72647

CVE-2026-72647 is a stack exhaustion vulnerability in Elasticsearch's query parsing layer. An authenticated user with read-only index access can submit deeply nested query structures — nested field queries, inner_hits with scripted sorting, chained aggregations, or custom analyzers with nested components — that cause unbounded recursion during deserialization, exhausting the thread's call stack and crashing the query execution thread. The critical insight here is that read-only index access in Elasticsearch is not truly read-only in the traditional sense. The query DSL is a programmable interface; granting someone read access to an index with complex field mappings, scripted fields, or nested object structures is closer to granting limited code execution than traditional data read access. The authorization model checks identity and role at the API gateway, but the query parsing code that processes nested payloads runs without structural depth enforcement — authentication passes, but the execution pipeline implicitly trusts that any authenticated query is safe to process at full recursion depth. This vulnerability fits a known lineage in Elasticsearch: multiple CWE-674 disclosures (uncontrolled recursion) have shipped over years, each triggered by different query composition paths. The patch pattern is consistent — add a depth counter at the specific subsystem boundary that triggered the recursion — but the architectural assumption remains unchanged: user-submitted query compositions should not exhaust server resources. This is a systemic assumption, not a one-off oversight, and the pattern will likely produce another CVE in this lineage within 12-18 months when a different composition path is discovered. Practical guidance: First, audit which indices expose nested field mappings, scripted fields, or custom analyzers to low-privilege users. These are the composition layers where recursion triggers. Second, review your query timeout and thread pool configurations — if stack exhaustion occurs mid-query, Elasticsearch's thread pool may treat this as unrecoverable thread death rather than a catchable exception, meaning partial results and retry load cascade to remaining nodes. Third, treat the CVSS 'medium' score with skepticism; it scores against a single node, but in a distributed cluster the blast radius includes incomplete query results, retry storms, and potential shard replica divergence if the failure occurs during the aggregation phase. The patch likely adds targeted depth tracking for whichever query vector triggered this specific CVE. That resolves this instance but does not resolve the architectural class. Monitor your Elasticsearch release notes for the next CWE-674 variant in this lineage — the pattern is predictable, even if the specific trigger varies.

Reviewed through automated stages and approved by a human before publication.