CVE-2026-72685
No fix known EPSS <1%CVSS 4.3
A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the availability of indexing operations on the affected node.
Products: Elasticsearch
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | elasticsearch-9.2 | no fix |
| Chainguard | elasticsearch-9.3 | no fix |