CVE-2026-72639

Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user holding only read privileges on a single searchable index can submit one small search request that causes the node to reserve an excessively large internal data structure. The allocation occurs before the existing highlighting safety limits are evaluated, so memory exhaustion raises a fatal error that terminates the Elasticsearch node process. This results in a denial of service for the affected node and degrades cluster routing and health. The defect is not volumetric and does not depend on the size of the indexed data, so a single request is sufficient.

• CWE-789

• https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-120/389503Vendor Advisory

Published

Aug 13, 2026

Last Modified

Sep 1, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72630Incorrect Authorization (CWE-863) in Kibana Fleet can lead t…7.1
• CVE-2026-72631Improper Privilege Management (CWE-269) in Kibana Fleet can …6.5
• CVE-2026-72632Observable Discrepancy (CWE-203) in Kibana Fleet can lead to…7.1
• CVE-2026-72633Incorrect Authorization (CWE-863) in Kibana Entity Analytics…4.3
• CVE-2026-72636Uncontrolled Recursion (CWE-674) in the Elasticsearch wildca…6.5
• CVE-2026-72638Uncontrolled Recursion (CWE-674) in Elasticsearch can lead t…6.5
• CVE-2026-7264A weakness has been identified in SourceCodester Pizzafy Eco…6.3
• CVE-2026-72640The Elastic Cloud on Kubernetes (ECK) operator reads a list …6.5
• CVE-2026-72641Incorrect Authorization (CWE-863) in Kibana can lead to unau…5.4
• CVE-2026-72642The native inference process that Elasticsearch uses to eval…8.8
• CVE-2026-72643Kibana Agent Builder determines whether a caller owns a priv…7.1
• CVE-2026-72644Uncaught Exception (CWE-248) in Kibana can lead to a denial …6.5