CVE-2026-72678 in Elasticsearch
Summary
by MITRE • 08/13/2026
Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to attempt an excessively large allocation. The resulting memory exhaustion raises a fatal error that terminates the Elasticsearch node process, causing a denial of service for the affected node and degrading cluster health. The defect is not volumetric, so a single request is sufficient regardless of the heap size configured on the target node.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
This vulnerability represents a critical memory exhaustion flaw in Elasticsearch systems that enables denial of service through improper input validation. The technical weakness stems from insufficient validation of user-supplied size parameters within internal data structure allocation mechanisms, creating a condition where maliciously crafted requests can trigger excessive memory consumption regardless of the system's heap configuration. The vulnerability operates at the core memory management layer of Elasticsearch, specifically affecting how the system processes and validates size parameters during internal operations that require memory reservation for data structures.
The operational impact of this vulnerability extends beyond simple service disruption as it allows authenticated users with read privileges to execute a single malicious request that can terminate the entire Elasticsearch node process. This represents a significant escalation risk since the attacker does not require elevated privileges or complex multi-stage attacks to exploit the weakness. The flaw is particularly dangerous because it operates independently of heap size configurations, meaning even systems configured with substantial memory resources remain vulnerable to this single request attack vector. From an attack perspective, this vulnerability aligns with techniques described in the ATT&CK framework under process injection and privilege escalation categories, as it exploits legitimate system functionality to cause unauthorized service disruption.
The root cause of this issue can be mapped to CWE-129, which addresses insufficient input validation, specifically focusing on inadequate validation of input values that could lead to memory allocation issues. This vulnerability demonstrates how seemingly benign parameter handling can create catastrophic system failures when proper bounds checking is omitted from critical internal operations. The flaw exists within the product's API endpoint processing logic where user-supplied size values are directly consumed without appropriate validation mechanisms to ensure they fall within acceptable operational parameters. Organizations affected by this vulnerability experience immediate and severe degradation of cluster health, as node termination creates cascading failures that impact data availability and system reliability.
Mitigation strategies must address both immediate remediation and long-term architectural improvements to prevent similar issues from occurring in production environments. The primary fix involves implementing robust input validation for all size parameters that are used in memory allocation calculations, ensuring that values remain within reasonable bounds before any allocation operations occur. Security teams should consider implementing rate limiting mechanisms and monitoring for unusual allocation patterns that could indicate exploitation attempts. Additionally, organizations should review their Elasticsearch configurations to ensure proper resource limits are enforced at multiple levels including JVM heap settings, thread pool configurations, and request size restrictions. The vulnerability highlights the importance of defense-in-depth strategies where multiple validation layers protect against similar memory-related flaws that could compromise system availability and integrity.