What is CVE-2026-72645?

CVE-2026-72645 is a medium-severity vulnerability in Elastic Elasticsearch, classified under CWE-789. CVSS score: 6.5/10. Published 2026-08-13.

How severe is CVE-2026-72645?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Elastic Elasticsearch

CVE-2026-72645

Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding only read privileges on a single index can submit one small, specially crafted search request that causes an excessively large memory allocation, exhausting the JVM heap and terminating the affected node.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Affected products

Elastic Elasticsearch — versions 8.0.0, 9.0.0, 9.5.0

Weakness classification (CWE)

CWE-789

References

security@elastic.co

Frequently asked questions

What is CVE-2026-72645?: CVE-2026-72645 is a medium-severity vulnerability in Elastic Elasticsearch, classified under CWE-789. CVSS score: 6.5/10. Published 2026-08-13.
How severe is CVE-2026-72645?: Medium severity. CVSS v3 base score is 6.5 out of 10.