Executive brief
Elasticsearch, a popular search and analytics engine, fails to validate user input on a search highlighting parameter, allowing an authenticated attacker to trigger excessive memory allocation. An attacker with only read access to any index can submit a single request that forces the server to reserve an extremely large memory block, causing the Elasticsearch node to crash and become unavailable. This disrupts service for all applications relying on that node and degrades the health of the entire search cluster.
Technical details
The vulnerability stems from a missing upper-bound check on a user-supplied count parameter in the search highlighting functionality (CWE-789: Memory Allocation with Excessive Size Value). An authenticated user with read privileges on a single searchable index can submit a crafted search request with an unbounded highlighting parameter value. The allocation of the internal data structure derived from this parameter occurs before existing safety limits are evaluated and is not accounted against any circuit breaker mechanism. This causes immediate out-of-memory exhaustion that terminates the Elasticsearch node process with a fatal error, resulting in a denial of service. The attack is non-volumetric and does not require large indexed data, making it trivial to exploit. Patched versions include Elasticsearch 8.19.20, 9.4.5, and 9.5.1.
Affected products
- Elastic Elasticsearch 8.19.0–8.19.19, 9.3.0–9.5.0
Timeline
- 2026-08-13: disclosed: CVE-2026-72639 published
- 2026-08-13: patched: Fixes released in Elasticsearch 8.19.20, 9.4.5, 9.5.1