← Back

CVE-2026-72645

nvd nist
Published: Aug 13, 2026Modified: Sep 1, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability: 2.8 / Impact: 3.6
Source: security@elastic.co (Secondary)

Description

Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a single index can submit one small, specially crafted search request that causes an excessively large memory allocation, exhausting the JVM heap and terminating the affected node.

Affected (3)

Elastic
1 product
Elasticsearch
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Elastic
Elasticsearch
From 8.0.0 to 8.19.20
Elasticsearch
From 9.0.0 to 9.4.5
Elasticsearch
From 9.5.0 to 9.5.1

Related CWEs

CWE-789
Memory Allocation with Excessive Size Value
The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

References (1)

Source: security@elastic.co
Vendor Advisory

Timeline

No history available yet.