CVE-2026-72684

Received Received - Intake

Authenticated User Memory Exhaustion in Elasticsearch

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the scope of the existing memory accounting controls that were intended to constrain it. The resulting out-of-memory condition is fatal and terminates the affected node process, causing a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72684

EUVD

EUVD-2026-58248

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	*
elastic	elasticsearch	From 8.0.0 (inc) to 8.19.19 (inc)
elastic	elasticsearch	From 9.0.0 (inc) to 9.4.4 (inc)
elastic	elasticsearch	8.19.20
elastic	elasticsearch	9.4.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-72684 is a flaw in Elasticsearch where an authenticated user with read privileges can submit a crafted search request. This input causes an internal component to allocate excessive memory without bounds, bypassing existing memory controls. The result is an out-of-memory condition that crashes the affected node, causing a denial of service.

Detection Guidance

Check Elasticsearch version with: curl -XGET 'http://localhost:9200'. If running versions 8.0.0-8.19.19 or 9.0.0-9.4.4, the system is vulnerable. Monitor for node crashes or out-of-memory errors in logs.

Impact Analysis

This vulnerability can cause service disruption by crashing Elasticsearch nodes, leading to downtime for applications relying on it. It requires an attacker to have valid credentials with read access, but once exploited, it can affect system availability and performance.

Mitigation Strategies

Upgrade Elasticsearch to version 8.19.20 or 9.4.5 immediately. If upgrading is not possible, restrict network access to Elasticsearch nodes and limit user privileges to reduce attack surface.

Hi! I’m here to help you understand CVE-2026-72684. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70