# CVE-2026-72639: Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service

> CVE-2026-72639: Memory Allocation with Excessive Size Value in Elasticsearch Highlighting Leading to Denial of Service. CVSS 6.5 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-72639
Last updated: 2026-09-01T14:08:36Z

- Published: 2026-08-13 19:13 UTC · Updated: 2026-09-01 14:08 UTC · Assigner: elastic
- CVSS: 6.5 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS: 0.42%, 36th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-789

## Description

Elasticsearch does not enforce an upper bound on a user-supplied count accepted by a search highlighting option, and the allocation derived from that count is not accounted against any circuit breaker. An authenticated user holding only read privileges on a single searchable index can submit one small search request that causes the node to reserve an excessively large internal data structure. The allocation occurs before the existing highlighting safety limits are evaluated, so memory exhaustion raises a fatal error that terminates the Elasticsearch node process. This results in a denial of service for the affected node and degrades cluster routing and health. The defect is not volumetric and does not depend on the size of the indexed data, so a single request is sufficient.

## Affected vendors and products

- Elastic: Elasticsearch

## Tracked companies

- [Elastic Cloud](https://rewindex.com/company/elastic-cloud.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-72639)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-72639)
- [https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-120/389503](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-120/389503)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-72639 · Markdown: https://rewindex.com/cve/CVE-2026-72639.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-72639 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:14:00.710Z