CVE-2026-72678
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Elasticsearch does not validate a size value from user input before using it to reserve memory for an internal data structure. An authenticated user with read-only privileges can send a single crafted request causing an excessively large allocation. Memory exhaustion raises a fatal error that terminates the node process, causing denial of service and degrading cluster health.
Risk Assessment
A single request can bring down an Elasticsearch node, leading to service unavailability and cluster degradation. The attack is not volumetric, making it easy to execute.
Recommendation
Apply the Elasticsearch update containing the fix. Restrict API access to trusted users and monitor memory allocations.
Original NVD description (English source)
Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to attempt an excessively large allocation. The resulting memory exhaustion raises a fatal error that terminates the Elasticsearch node process, causing a denial of service for the affected node and degrading cluster health. The defect is not volumetric, so a single request is sufficient regardless of the heap size configured on the target node.