CVE-2026-72656
published 2026-08-13CVE-2026-72656: Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation…
PriorityP335medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.42%
34.3th percentile
Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation allocates an unbounded amount of heap memory, exhausting the available heap on the receiving node and causing the node to become unavailable.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | >= 8.11.0 < 8.18.0 | 8.18.0 |
| elastic | elasticsearch | 8.11.0 – 8.17.9 | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Elastic Elasticsearch up to 8.17.9 ES|QL Query Processing memory allocation (WID-SEC-2026-2841)
vuldb·2026-08-16·CVSS 6.5
CVE-2026-72656 [MEDIUM] Elastic Elasticsearch up to 8.17.9 ES|QL Query Processing memory allocation (WID-SEC-2026-2841)
A vulnerability categorized as problematic has been discovered in Elastic Elasticsearch up to 8.17.9. Affected by this vulnerability is an unknown functionality of the component ES|QL Query Processing. The manipulation results in uncontrolled memory allocation.
This vulnerability is identified as CVE-2026-72656. The attack can be executed remotely. There is not any exploit available.
GHSA
Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
ghsa_unreviewed·2026-08-13
CVE-2026-72656 [MEDIUM] CWE-789 Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130).
Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation allocates an unbounded amount of heap memory, exhausting the available heap on the receiving node and causing the node to become unavailable.
Red Hat
elasticsearch: Elasticsearch: Denial of Service via excessive memory allocation in ES|QL queries
vendor_redhat·2026-08-13·CVSS 6.5
CVE-2026-72656 [MEDIUM] CWE-789 elasticsearch: Elasticsearch: Denial of Service via excessive memory allocation in ES|QL queries
elasticsearch: Elasticsearch: Denial of Service via excessive memory allocation in ES|QL queries
A flaw was found in Elasticsearch. An authenticated user, by submitting a specially crafted ES|QL query, could trigger an unbounded allocation of heap memory. This excessive memory consumption exhausts the available resources on the receiving node, leading to a denial of service (DoS) condition where the node becomes unavailable.
Statement: A memory allocation flaw exists in Elasticsearch's ES|QL query processing engine. When evaluating a specially crafted ES|QL query, the engine fails to enforce upper bounds on memory allocation requests, triggering unbounded heap consumption. An authenticated remote attacker can exploit this issue by submitting malformed queries to exhaust the receiving nod
No detection rules found.
No public exploits indexed.
2026-08-13
Published