Vulnerability · Published Aug 13, 2026 · Assigned by elastic
CVE-2026-72656Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
Medium 6.5
In plain English
A medium-severity security flaw in Elasticsearch from Elastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Official description
Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation allocates an unbounded amount of heap memory, exhausting the available heap on the receiving node and causing the node to become unavailable.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Elasticsearch | 8.11.0 – through 8.17.9 |
Weakness: CWE-789 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H