CVE-2026-72639

Received Received - Intake

Memory Exhaustion in Elasticsearch via Highlighting Option

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user holding only read privileges on a single searchable index can submit one small search request that causes the node to reserve an excessively large internal data structure. The allocation occurs before the existing highlighting safety limits are evaluated, so memory exhaustion raises a fatal error that terminates the Elasticsearch node process. This results in a denial of service for the affected node and degrades cluster routing and health. The defect is not volumetric and does not depend on the size of the indexed data, so a single request is sufficient.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72639

EUVD

EUVD-2026-58285

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	*
elastic	elasticsearch	to 8.19.19 (inc)
elastic	elasticsearch	to 9.5.0 (inc)
elastic	elasticsearch	8.19.20
elastic	elasticsearch	9.4.5
elastic	elasticsearch	9.5.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-72639 is a denial-of-service vulnerability in Elasticsearch where an authenticated user with read access to a single index can submit a small search request that causes excessive memory allocation. The system fails to enforce limits on a user-supplied count in a search highlighting option, leading to memory exhaustion before safety checks are applied. This terminates the Elasticsearch node and degrades cluster health.

Detection Guidance

Check Elasticsearch server logs for unexpected node terminations due to out-of-memory errors. Look for fatal errors or crashes in logs that indicate memory exhaustion after a search request.

Impact Analysis

This vulnerability can cause unexpected node crashes due to out-of-memory errors, disrupting search functionality and degrading cluster performance. It may lead to downtime for services relying on Elasticsearch, affecting data availability and system reliability.

Mitigation Strategies

Upgrade Elasticsearch to versions 8.19.20, 9.4.5, or 9.5.1 or later to patch the vulnerability. If upgrading is not possible, there are no effective workarounds.

Hi! I’m here to help you understand CVE-2026-72639. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70