CVE-2026-72684

Katalog CVE

CVSS 6.5 · Medium EPSS 0,42%

Kerentanan Allocation of Resources Without Limits or Throttling pada elasticsearch. Skor CVSS 3.1 6.5 (Medium) menurut elastic.co.

Deskripsi (NVD)

A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the scope of the existing memory accounting controls that were intended to constrain it. The resulting out-of-memory condition is fatal and terminates the affected node process, causing a denial of service.

Rincian

Terbit di NVD

13 Agustus 2026

Terakhir diubah

1 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber elastic.co
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-76/389508 advisory vendor