CVE-2026-72645

Received Received - Intake

Memory Allocation DoS in Elasticsearch

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a single index can submit one small, specially crafted search request that causes an excessively large memory allocation, exhausting the JVM heap and terminating the affected node.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72645

EUVD

EUVD-2026-58282

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	*
elastic	elasticsearch	to 8.19.19 (inc)
elastic	elasticsearch	to 9.4.4 (inc)
elastic	elasticsearch	to 9.5.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-72645 is a memory allocation vulnerability in Elasticsearch where an authenticated user with read access to a single index can send a specially crafted search request. This request triggers an excessively large memory allocation, consuming all available JVM heap space and causing the affected node to crash, resulting in a denial of service.

Detection Guidance

Monitor Elasticsearch logs for unusually large memory allocations or JVM heap exhaustion events. Check for search requests with excessive response sizes or abnormal memory usage patterns. Use Elasticsearch APIs like _nodes/stats to track heap usage and _cluster/allocation/explain to identify problematic allocations.

Impact Analysis

This vulnerability can cause system outages by crashing Elasticsearch nodes, leading to downtime for services relying on the database. It may disrupt data availability and require manual intervention to restart nodes, affecting operations dependent on Elasticsearch.

Mitigation Strategies

Upgrade Elasticsearch to versions 8.19.20, 9.4.5, or 9.5.1 immediately. If upgrading is not possible, restrict user access to only necessary indices and limit search request sizes through configuration. Monitor affected nodes closely for signs of memory exhaustion.

Hi! I’m here to help you understand CVE-2026-72645. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70