VDB
CVE-2026-72645
CVE-2026-72645
PUBLISHED
CVSS 6.5 MEDIUM
Reported by elastic · Published August 13, 2026
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a single index can submit one small, specially crafted search request that causes an excessively large memory allocation, exhausting the JVM heap and terminating the affected node.
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Elasticsearch | 8.0.0, 9.0.0, 9.5.0 |
| Elastic | Elasticsearch | 8.0.0, 9.5.0, 9.0.0 |
| wolfi | ruby3.2-elasticsearch | * |
| chainguard | ruby3.3-elasticsearch | * |
| chainguard | ruby3.4-elasticsearch | * |
| wolfi | ruby3.4-elasticsearch | * |
| chainguard | ruby3.2-elasticsearch | * |
| wolfi | ruby4.0-elasticsearch | * |
| chainguard | ruby4.0-elasticsearch | * |
| wolfi | ruby3.3-elasticsearch | * |
Timeline
- Aug 13, 2026 CVE Published
- Aug 13, 2026 CVE Updated
- Aug 14, 2026 Coalition ESS Score
- Aug 24, 2026 EPSS Score
- Aug 28, 2026 EPSS Score
- Sep 2, 2026 EPSS Score
- Sep 6, 2026 EPSS Score
- Sep 6, 2026 Security Advisory
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score