Skip to main content

Elasticsearch CVE-2026-72656

| EUVDEUVD-2026-58279 MEDIUM
Memory Allocation with Excessive Size Value (CWE-789)
2026-08-13 elastic GHSA-gpg2-7m3g-5qc5
Denial Of Service Elastic Elasticsearch
6.5
CVSS 3.1 · Vendor: elastic
Share

Severity by source

Vendor (elastic) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
6.5 MEDIUM

Network-delivered ES|QL query requires only a low-privilege account; no data exposure or integrity impact, only heap exhaustion with high availability consequence on the targeted node.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Aug 13, 2026 - 20:12 vuln.today
CVE Published
Aug 13, 2026 - 19:13 cve.org
MEDIUM 6.5

DescriptionCVE.org

Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation allocates an unbounded amount of heap memory, exhausting the available heap on the receiving node and causing the node to become unavailable.

AnalysisAI

ES|QL query processing in Elasticsearch allows an authenticated low-privileged user to exhaust heap memory on any receiving cluster node by submitting a specially crafted query, rendering that node unavailable. The CVSS 6.5 score (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects remote, low-complexity exploitation requiring only a valid account, with high availability impact but no data exposure. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid Elasticsearch user account with privileges sufficient to submit ES|QL queries - the CVSS PR:L metric confirms low-privilege authenticated access is sufficient and no administrative role is needed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H precisely characterizes this as a credentialed denial-of-service with no confidentiality or integrity consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade Elasticsearch to version 8.18.0 (for 8.x deployments) or 9.0.0 (for 9.x deployments), as documented in Elastic security advisory ESA-2026-111 at https://discuss.elastic.co/t/elasticsearch-8-18-0-9-0-0-security-update-esa-2026-111/389495. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Elasticsearch

View all
CVE-2015-5531 MEDIUM POC
5.0 Aug 17

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unsp
CVE-2015-3337 MEDIUM POC
4.3 May 01

Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, a
CVE-2023-31419 HIGH
7.5 Oct 26

A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause
CVE-2021-22146 HIGH POC
7.5 Jul 21

All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters.
CVE-2021-22145 MEDIUM POC
6.5 Jul 21

A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. Rated medium severit
CVE-2026-72642 HIGH
8.8 Aug 13

Heap corruption and potential remote code execution in Elasticsearch's native ML inference engine can be triggered by an
CVE-2020-7014 HIGH
8.8 Jun 03

The fix for CVE-2020-7009 was found to be incomplete. Rated high severity (CVSS 8.8), this vulnerability is remotely exp
CVE-2020-7009 HIGH
8.8 Mar 31

Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker
CVE-2018-3831 HIGH
8.8 Sep 19

Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secre
CVE-2019-7611 HIGH
8.1 Mar 25

A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Le
CVE-2015-4165 HIGH
7.5 Aug 09

The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files

CVE-2023-46674 HIGH
7.8 Dec 05

An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration prope

Same weakness CWE-789 – Memory Allocation with Excessive Size Value

View all
CVE-2026-59204 HIGH POC
8.7
CVE-2018-25368 HIGH POC
8.7
CVE-2021-47973 HIGH POC
8.7
CVE-2021-47972 HIGH POC
8.7
CVE-2021-47971 HIGH POC
8.7
CVE-2021-47970 HIGH POC
8.7
CVE-2021-47969 HIGH POC
8.7
CVE-2021-47944 HIGH POC
8.7

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Share

CVE-2026-72656 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy