CVE-2026-72645
published 2026-08-13CVE-2026-72645: Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated…
PriorityP336medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.42%
34.3th percentile
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a single index can submit one small, specially crafted search request that causes an excessively large memory allocation, exhausting the JVM heap and terminating the affected node.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | — | — |
| elastic | elasticsearch | >= 8.0.0 < 8.19.20 | 8.19.20 |
| elastic | elasticsearch | 8.0.0 – 8.19.19 | — |
| elastic | elasticsearch | >= 9.0.0 < 9.4.5 | 9.4.5 |
| elastic | elasticsearch | 9.0.0 – 9.4.4 | — |
| elastic | elasticsearch | >= 9.5.0 < 9.5.1 | 9.5.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Elastic Elasticsearch up to 8.19.19/9.4.4/9.5.0 Search Request memory allocation (WID-SEC-2026-2841)
vuldb·2026-08-16·CVSS 6.5
CVE-2026-72645 [MEDIUM] Elastic Elasticsearch up to 8.19.19/9.4.4/9.5.0 Search Request memory allocation (WID-SEC-2026-2841)
A vulnerability was found in Elastic Elasticsearch up to 8.19.19/9.4.4/9.5.0. It has been classified as problematic. This affects an unknown function of the component Search Request. Performing a manipulation results in uncontrolled memory allocation.
This vulnerability was named CVE-2026-72645. The attack may be initiated remotely. There is no available exploit.
GHSA
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
ghsa_unreviewed·2026-08-13
CVE-2026-72645 [MEDIUM] CWE-789 Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a single index can submit one small, specially crafted search request that causes an excessively large memory allocation, exhausting the JVM heap and terminating the affected node.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-13
Published