CVE-2026-72656

Received Received - Intake

Memory Allocation DoS in Elasticsearch ES|QL

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation allocates an unbounded amount of heap memory, exhausting the available heap on the receiving node and causing the node to become unavailable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72656

EUVD

EUVD-2026-58279

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	*
elastic	elasticsearch	to 8.18.0 (inc)
elastic	elasticsearch	to 9.0.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-72656 is a memory allocation vulnerability in Elasticsearch's ES|QL query processing. An authenticated user can send a specially crafted query that allocates excessive heap memory, causing a denial of service by exhausting system resources on the affected node.

Detection Guidance

Monitor Elasticsearch logs for unusually high memory usage during ES|QL query processing. Check for queries with excessive memory allocation patterns or failures due to heap exhaustion. Use Elasticsearch's built-in monitoring APIs like _nodes/stats to track heap usage and query execution metrics.

Impact Analysis

This vulnerability can cause the Elasticsearch node to become unavailable due to memory exhaustion. This may lead to service disruptions, degraded performance, or complete outages for applications relying on Elasticsearch.

Mitigation Strategies

Upgrade Elasticsearch to versions 8.18.0 or 9.0.0 or later to resolve the vulnerability. If upgrading is not immediately possible, restrict access to ES|QL query submission to trusted users only and monitor for suspicious query patterns.

Hi! I’m here to help you understand CVE-2026-72656. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70