Is CVE-2026-72685 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-72685?

CVE-2026-72685 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-72685

Description

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the availability of indexing operations on the affected node.