CVE-2026-72678

Received Received - Intake

Memory Exhaustion in Elasticsearch via API Request

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to attempt an excessively large allocation. The resulting memory exhaustion raises a fatal error that terminates the Elasticsearch node process, causing a denial of service for the affected node and degrading cluster health. The defect is not volumetric, so a single request is sufficient regardless of the heap size configured on the target node.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72678

EUVD

EUVD-2026-58252

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	*
elastic	elasticsearch	From 8.19.0 (inc) to 8.19.19 (inc)
elastic	elasticsearch	From 9.4.0 (inc) to 9.4.4 (inc)
elastic	elasticsearch	9.5.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

Elasticsearch fails to validate a size value from user input before using it to reserve memory. An authenticated attacker with read privileges can send a single crafted request to an API endpoint, causing the node to attempt an abnormally large memory allocation. This leads to memory exhaustion, a fatal error, and termination of the Elasticsearch node, resulting in a denial of service.

Detection Guidance

Monitor Elasticsearch server logs for fatal out-of-memory errors or unexpected node terminations. Check for single crafted requests to API endpoints that trigger excessive memory allocation. Ensure Elasticsearch versions are updated to 8.19.20, 9.4.5, or 9.5.1 or later.

Impact Analysis

This vulnerability allows an attacker to crash an Elasticsearch node with a single request, disrupting search and indexing operations. It degrades cluster health and may cause downtime for services relying on Elasticsearch. Affected deployments are those where an attacker can authenticate to the REST API.

Mitigation Strategies

Upgrade Elasticsearch to versions 8.19.20, 9.4.5, or 9.5.1 or later immediately. If upgrading is not possible, restrict API access to trusted users only to prevent exploitation.

Hi! I’m here to help you understand CVE-2026-72678. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70