Denial of Service Vulnerability in Elasticsearch by Elastic

CVE-2026-72639

What is CVE-2026-72639?

A vulnerability in Elasticsearch allows an authenticated user with read privileges to submit a specially crafted search request, leading to excessive memory allocation. This unbounded allocation occurs before safety limits are applied, resulting in memory exhaustion that crashes the Elasticsearch node. This denial of service not only impacts the affected node but can also degrade overall cluster health and routing efficiency, making it crucial for users to apply security updates promptly.

References