CLEANSTART-2026-EO25497: Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker

Q: Who is exposed to this issue?

Deployments are exposed where users can submit search requests that use the affected highlighting option. The issue is associated with the cleanstart/sonarqube package.

Q: What does an attacker need to do to trigger the vulnerable allocation?

The attacker needs to supply a count through the affected search highlighting option. That count has no enforced upper bound, and the resulting allocation is not tracked by a circuit breaker.

Published Nov 7, 2026

Updated

Security vulnerability affects the sonarqube package. Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker.

Affected Software

1 affected componentFixes available

cleanstart/sonarqube<26.8.0.126808-r5

26.8.0.126808-r5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/sonarqube to a version that resolves this vulnerability.
Fixed in 26.8.0.126808-r5

Event History

Nov 7, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-72639

Frequently Asked Questions

Who is exposed to this issue?

Deployments are exposed where users can submit search requests that use the affected highlighting option. The issue is associated with the cleanstart/sonarqube package.

What does an attacker need to do to trigger the vulnerable allocation?

The attacker needs to supply a count through the affected search highlighting option. That count has no enforced upper bound, and the resulting allocation is not tracked by a circuit breaker.

CLEANSTART-2026-EO25497: Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the vulnerable allocation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the vulnerable allocation?