CVE-2026-72645
Last modified
CVE-2026-72645 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a single index can submit one small, specially crafted search request that causes an excessively large memory allocation, exhausting the JVM heap and terminating the affected node.. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a single index can submit one small, specially crafted search request that causes an excessively large memory allocation, exhausting the JVM heap and terminating the affected node.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Elasticsearch | >= 8.0.0, < 8.19.20 |
| Elastic | Elasticsearch | >= 9.0.0, < 9.4.5 |
| Elastic | Elasticsearch | >= 9.5.0, < 9.5.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-72645?
How severe is CVE-2026-72645?
How do I fix CVE-2026-72645?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-7264A weakness has been identified in SourceCodester Pizzafy Eco…6.3
- CVE-2026-72640The Elastic Cloud on Kubernetes (ECK) operator reads a list …6.5
- CVE-2026-72641Incorrect Authorization (CWE-863) in Kibana can lead to unau…5.4
- CVE-2026-72642The native inference process that Elasticsearch uses to eval…8.8
- CVE-2026-72643Kibana Agent Builder determines whether a caller owns a priv…7.1
- CVE-2026-72644Uncaught Exception (CWE-248) in Kibana can lead to a denial …6.5
- CVE-2026-72647Uncontrolled Recursion (CWE-674) in Elasticsearch can lead t…6.5
- CVE-2026-72648Cleartext Storage of Sensitive Information in an Environment…6.5
- CVE-2026-72649Deserialization of Untrusted Data (CWE-502) in the Elasticse…8.8
- CVE-2026-7265A security vulnerability has been detected in SourceCodester…6.3
- CVE-2026-72650Authorization Bypass Through User-Controlled Key (CWE-639) i…4.3
- CVE-2026-72651Allocation of Resources Without Limits or Throttling (CWE-77…6.5
Are you affected by CVE-2026-72645?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST