CVE-2026-72687
published 2026-08-13CVE-2026-72687: A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.42%
34.3th percentile
A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the identifier drives an allocation that is neither capped nor accounted for by the available memory-usage controls. The resulting out-of-memory condition is fatal and terminates the affected node process, resulting in a denial of service.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | elasticsearch | — | — |
| elastic | elasticsearch | >= 8.0.0 < 8.19.20 | 8.19.20 |
| elastic | elasticsearch | 8.0.0 – 8.19.19 | — |
| elastic | elasticsearch | >= 9.0.0 < 9.4.5 | 9.4.5 |
| elastic | elasticsearch | 9.0.0 – 9.4.4 | — |
| elastic | elasticsearch | >= 9.5.0 < 9.5.1 | 9.5.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier.
ghsa_unreviewed·2026-08-13
CVE-2026-72687 [MEDIUM] CWE-789 A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier.
A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the identifier drives an allocation that is neither capped nor accounted for by the available memory-usage controls. The resulting out-of-memory condition is fatal and terminates the affected node process, resulting in a denial of service.
VulDB
Elastic Elasticsearch up to 8.19.19/9.4.4/9.5.0 allocation of resources
vuldb·2026-08-13·CVSS 6.5
CVE-2026-72687 [MEDIUM] Elastic Elasticsearch up to 8.19.19/9.4.4/9.5.0 allocation of resources
A vulnerability identified as problematic has been detected in Elastic Elasticsearch up to 8.19.19/9.4.4/9.5.0. This affects an unknown part. Performing a manipulation results in allocation of resources.
This vulnerability was named CVE-2026-72687. The attack may be initiated remotely. There is no available exploit.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-08-13
Published