CVE-2026-72656

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Published

Aug 13, 2026, 7:13:26 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.42% · Oct 25, 2026

A flaw was found in Elasticsearch. An authenticated user, by submitting a specially crafted ES|QL query, could trigger an unbounded allocation of heap memory. This excessive memory consumption exhausts the available resources on the receiving node, leading to a denial of service (DoS) condition where the node becomes unavailable. A memory allocation flaw exists in Elasticsearch's ES|QL query processing engine. When evaluating a specially crafted ES|QL query, the engine fails to enforce upper bounds on memory allocation requests, triggering unbounded heap consumption. An authenticated remote attacker can exploit this issue by submitting malformed queries to exhaust the receiving node's heap memory, causing node instability or service crashes, posing an Important impact to availability. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.