CVE-2026-72684
published 2026-08-13CVE-2026-72684: A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input…
PriorityP338medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.42%
34.3th percentile
A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the scope of the existing memory accounting controls that were intended to constrain it. The resulting out-of-memory condition is fatal and terminates the affected node process, causing a denial of service.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | >= 8.0.0 < 8.19.20 | 8.19.20 |
| elastic | elasticsearch | 8.0.0 – 8.19.19 | — |
| elastic | elasticsearch | >= 9.0.0 < 9.4.5 | 9.4.5 |
| elastic | elasticsearch | 9.0.0 – 9.4.4 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Elastic Elasticsearch up to 8.19.19/9.4.4 allocation of resources
vuldb·2026-08-13·CVSS 6.5
CVE-2026-72684 [MEDIUM] Elastic Elasticsearch up to 8.19.19/9.4.4 allocation of resources
A vulnerability was found in Elastic Elasticsearch up to 8.19.19/9.4.4. It has been rated as problematic. Affected by this vulnerability is an unknown functionality. This manipulation causes allocation of resources.
This vulnerability is handled as CVE-2026-72684. The attack can be initiated remotely. There is not any exploit available.
GHSA
A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input.
ghsa_unreviewed·2026-08-13
CVE-2026-72684 [MEDIUM] CWE-770 A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input.
A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the scope of the existing memory accounting controls that were intended to constrain it. The resulting out-of-memory condition is fatal and terminates the affected node process, causing a denial of service.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-13
Published