CVE-2026-72639
CVE-2026-72639 is a medium-severity vulnerability in Elastic Elasticsearch with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-789.
Key facts
- Severity: Medium (CVSS 3.x base score 6.5)
- EPSS exploit prediction: 0% (34th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-789
- Affected product: Elastic Elasticsearch
- Published:
- Last modified:
Description
Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user holding only read privileges on a single searchable index can submit one small search request that causes the node to reserve an excessively large internal data structure. The allocation occurs before the existing highlighting safety limits are evaluated, so memory exhaustion raises a fatal error that terminates the Elasticsearch node process. This results in a denial of service for the affected node and degrades cluster routing and health. The defect is not volumetric and does not depend on the size of the indexed data, so a single request is sufficient.
Frequently asked questions
- What is CVE-2026-72639?
- Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user holding only read privileges on a single searchable index can submit one small search request that causes the node to reserve an excessively large internal data structure. The allocation occurs before the existing highlighting safety limits are evaluated, so memory exhaustion raises a fatal error that terminates the Elasticsearch node process. This results in a denial of service for the affected node and degrades cluster routing and health. The defect is not volumetric and does not depend on the size of the indexed data, so a single request is sufficient.
- How severe is CVE-2026-72639?
- CVE-2026-72639 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
- Is CVE-2026-72639 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-72639?
- CVE-2026-72639 affects Elastic Elasticsearch. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-72639?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2026-72639 published?
- CVE-2026-72639 was published on 2026-08-13 and last updated on 2026-09-01.
References
Affected products (1)
- cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*
More vulnerabilities in Elastic Elasticsearch
- CVE-2015-5377 — Critical (CVSS 9.8): Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the…
- CVE-2015-1427 — Critical (CVSS 9.8): The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the…
- CVE-2026-72649 — High (CVSS 8.8): Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code…
- CVE-2026-72642 — High (CVSS 8.8): The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model…
- CVE-2020-7014 — High (CVSS 8.8): The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1…
- CVE-2020-7009 — High (CVSS 8.8): Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an…
All CVEs affecting Elastic Elasticsearch →
Other CWE-789 vulnerabilities
- CVE-2026-82435 — Critical (CVSS 9.8): Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the…
- CVE-2026-77410 — High (CVSS 8.9): RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.recvContent in channel.go preallocates the…
- CVE-2021-34869 — High (CVSS 8.8): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop…
- CVE-2021-34868 — High (CVSS 8.8): This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop…
- CVE-2026-63574 — High (CVSS 8.7): Memory allocation with excessive size value in the OpenPGP signature and user attribute subpacket parsers…
- CVE-2026-103603 — High (CVSS 8.7): Memory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in…