Quick answers
- Is CVE-2026-72656 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-72656 being exploited in the wild.
- How severe is CVE-2026-72656?
- Medium severity, with a CVSS score of 6.5, published 13 August 2026.
- Which products and versions are affected?
- Elasticsearch 8.11.0 through 8.17.9.
- Is there a fix for CVE-2026-72656?
- A patch was published on 2026-08-13: Fixed in Elasticsearch 8.18.0 and 9.0.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-72656 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-72656?
- Check whether you run Elasticsearch at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a memory allocation vulnerability (CWE-789) in the ES|QL query processing component. An attacker with valid credentials and authorization to submit ES|QL queries can craft a query that triggers unbounded heap memory allocation during evaluation. The root cause is insufficient validation or limits on memory allocation in the query execution engine. Attack requires network access to Elasticsearch and a valid authenticated account with ES|QL query permissions; no further user interaction is needed. Successful exploitation causes a denial of service by exhausting available heap memory and crashing the affected node. The vulnerability was fixed in Elasticsearch versions 8.18.0 and 9.0.0. Versions 8.11.0 through 8.17.9 are affected (ES|QL was introduced in 8.11.0).
Affected products
- Elastic Elasticsearch 8.11.0 through 8.17.9
Timeline
- 2026-08-13: disclosed
- 2026-08-13: patched: Fixed in Elasticsearch 8.18.0 and 9.0.0