Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to attempt an excessively large allocation. The resulting memory exhaustion raises a fatal error that terminates the Elasticsearch node process, causing a denial of service for the affected node and degrading cluster health. The defect is not volumetric, so a single request is sufficient regardless of the heap size configured on the target node.
Affected Versions:
- All versions from 8.19.0 up to and including 8.19.19
- All versions from 9.4.0 up to and including 9.4.4
- Version 9.5.0
Affected Configurations:
- All Elasticsearch deployments running an affected version where an attacker can authenticate to the REST API
- The attacker requires only a role granting read privileges; no write, cluster, or administrative privileges are needed
Solutions and Mitigations:
The issue is resolved in version 8.19.20, 9.4.5, and 9.5.1.
For Users that Cannot Upgrade:
- There are no workarounds for this vulnerability.
Indicators of Compromise (IOC)
Unexpected termination of an Elasticsearch node process, accompanied by a fatal out-of-memory error recorded in the Elasticsearch server log immediately before the process exits, may indicate exploitation of this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE ID: CVE-2026-72678
Problem Type: CWE-789 - Memory Allocation with Excessive Size Value