CVE-2026-72684: elastic elasticsearch
Vulnerability summary
CVE-2026-72684 is a medium (CVSS 6.5) vulnerability in elastic elasticsearch. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 13-08-2026PublishedVulnerability first disclosed.
- 13-08-2026Last modifiedVulnerability information updated.
Description
A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the scope of the existing memory accounting controls that were intended to constrain it. The resulting out-of-memory condition is fatal and terminates the affected node process, causing a denial of service.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
+0.12 pp
From 0.30% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard4 products
- elasticsearch-8.19< 8.19.20-r0
- elasticsearch-9.2All versions (No fix recorded)
- elasticsearch-9.3All versions (No fix recorded)
- elasticsearch-9.4< 9.4.6-r0 | < 9.4.5-r0
Elastic1 product
- elasticsearch≥ 8.0.0, ≤ 8.19.19 | ≥ 9.0.0, ≤ 9.4.4 | ≥ 8.0.0, < 8.19.20 | ≥ 9.0.0, < 9.4.5
2 vendors · 5 products
