CVE-2026-72656
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Memory allocation with excessive size in ES|QL query processing of Elasticsearch can lead to denial of service. An authenticated user can submit a specially crafted query whose evaluation allocates unbounded heap memory, exhausting available heap on the receiving node and causing the node to become unavailable.
Risk Assessment
An attacker with ES|QL query privileges can cause unavailability of an Elasticsearch node, potentially affecting the entire cluster and disrupting dependent services.
Recommendation
Install vendor security patches and restrict privileges to execute ES|QL queries. Implement resource limits and memory usage monitoring on nodes.
Original NVD description (English source)
Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation allocates an unbounded amount of heap memory, exhausting the available heap on the receiving node and causing the node to become unavailable.