CVE-2026-72687

Received Received - Intake

Elasticsearch Denial of Service via Malicious Identifier

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the identifier drives an allocation that is neither capped nor accounted for by the available memory-usage controls. The resulting out-of-memory condition is fatal and terminates the affected node process, resulting in a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72687

EUVD

EUVD-2026-58251

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	*
elastic	elasticsearch	From 8.0.0 (inc) to 8.19.19 (inc)
elastic	elasticsearch	From 9.0.0 (inc) to 9.4.4 (inc)
elastic	elasticsearch	9.5.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-72687 is a flaw in Elasticsearch where a low-privileged authenticated user can send a crafted request with a forged opaque identifier. Elasticsearch decodes and deserializes this identifier, which contains a size value that triggers an unchecked memory allocation. This causes an out-of-memory condition, terminating the affected node and resulting in a denial of service.

Detection Guidance

Monitor Elasticsearch node processes for unexpected crashes or out-of-memory errors. Check logs for fatal termination events or memory allocation failures. Use Elasticsearch APIs like _nodes/stats to monitor memory usage and node health.

Impact Analysis

This vulnerability can cause your Elasticsearch cluster to crash due to an out-of-memory condition, leading to service disruption and potential data unavailability. It affects all configurations and requires no special privileges beyond basic authentication.

Mitigation Strategies

Upgrade Elasticsearch to versions 8.19.20, 9.4.5, or 9.5.1 immediately. If upgrading is not possible, restrict low-privileged user access to prevent exploitation. Monitor nodes closely for signs of instability.

Hi! I’m here to help you understand CVE-2026-72687. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70