Threats Tagged 'cve-2026-72684'

CVE-2026-72684 is a medium severity vulnerability in Elasticsearch that allows an authenticated user with read privileges to cause a denial of service. By submitting a crafted search request, the user can trigger unbounded memory allocation in an internal component outside existing memory controls. This leads to an out-of-memory condition that terminates the affected node process, disrupting service availability. The vulnerability affects Elasticsearch versions from 8.0.0 up to but not including 9.5.0. A patch is available to address this issue.

A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the scope of the existing memory accounting controls that were intended to constrain it. The resulting out-of-memory condition is fatal and terminates the affected node process, causing a denial of service.