Memory Allocation Vulnerability in Elasticsearch by Elastic

CVE-2026-72645

What is CVE-2026-72645?

A vulnerability in Elasticsearch allows an authenticated user with read privileges to exploit memory allocation processes. By sending a small, specifically crafted search request, the user can trigger an excessive memory allocation. This can exhaust the Java Virtual Machine (JVM) heap, leading to the termination of the affected node and causing a denial of service. Organizations using affected versions of Elasticsearch should implement mitigations to safeguard against potential disruptions.

References