Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service (CVE-2026-72639)

Elasticsearch's search highlighting feature accepts a user-supplied count parameter without enforcing an upper bound. The memory allocation derived from this count is not accounted for by any circuit breaker, allowing an authenticated user with read-only access on a single searchable index to trigger an excessively large memory reservation. This allocation occurs prior to the evaluation of existing highlighting safety limits, causing memory exhaustion that results in a fatal error terminating the Elasticsearch node process. The denial of service impacts node availability and cluster routing and health. The vulnerability affects Elasticsearch versions >=8.19.0 <8.19.20 and >=9.3.0 <9.5.1. A patch is available to fix this issue.

An authenticated user with read privileges on a single searchable index can cause an Elasticsearch node to terminate due to memory exhaustion triggered by a single crafted search request. This denial of service degrades cluster routing and overall cluster health. The issue is not volumetric and does not require large indexed data, making exploitation feasible with minimal input.

A patch is available for this vulnerability. Users should upgrade Elasticsearch to versions 8.19.20 or later, or 9.5.1 or later, where this issue is fixed. Until patched, restricting access to trusted users and monitoring for unusual search highlighting requests may reduce risk, but the primary mitigation is applying the official fix.