CVE-2026-72645

Published: Ago 13, 2026 Last Modified: Ago 13, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: none
Availability: high

Description

AI Translation Available

Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a single index can submit one small, specially crafted search request that causes an excessively large memory allocation, exhausting the JVM heap and terminating the affected node.

789

Memory Allocation with Excessive Size Value

Draft
Abstraction: Variant Structure: Simple
Common Consequences
Security Scopes Affected:
Availability
Potential Impacts:
Dos: Resource Consumption (Memory)
Applicable Platforms
Languages: C, C++, Not Language-Specific
View CWE Details
https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-…
https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-…