CVE-2026-72645: Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a single index can submit one small, specially crafted search request that causes an excessively large memory allocation, exhausting the JVM heap and terminating the affected node.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72645?
The severity of CVE-2026-72645 is medium with a score of 6.5.
What does CVE-2026-72645 affect?
CVE-2026-72645 affects Elasticsearch through a vulnerability in memory allocation.
What can be the consequence of exploiting CVE-2026-72645?
Exploiting CVE-2026-72645 can lead to a denial of service.
Who can exploit CVE-2026-72645?
An authenticated user with read privileges on a single index can exploit CVE-2026-72645.
How do I fix CVE-2026-72645?
To fix CVE-2026-72645, ensure you update to the latest version of Elasticsearch that addresses this vulnerability.