CVE-2026-72678

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Published

Aug 13, 2026, 7:11:02 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.47% · Oct 25, 2026

A flaw was found in Elasticsearch. An authenticated user with read privileges can submit a crafted request that causes the node to attempt an excessively large memory allocation due to unvalidated user input. This memory exhaustion leads to a fatal error, terminating the Elasticsearch node process and causing a Denial of Service (DoS) for the affected node. A single request is sufficient to trigger this issue. An unvalidated allocation flaw exists in Elasticsearch's API request processing mechanisms. When handling user-supplied size parameters during data structure initialization, Elasticsearch fails to bound memory allocation requests. An authenticated remote user with read-only privileges can submit a single crafted API request, forcing an excessively large heap allocation that triggers an Out-Of-Memory (OOM) fatal error and crashes the node process. This results in service disruption and degraded cluster health, posing a high impact to availability. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.