CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-72656

Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation allocates an unbounded amount of heap memory, exhausting the available heap on the receiving node and causing the node to become unavailable.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.003

EPSS Ranking 21.9%

CVSS Severity

CVSS v3 Score 6.5

References

https://discuss.elastic.co/t/elasticsearch-8-18-0-9-0-0-security-update-esa-2026-111/389495

Products affected by CVE-2026-72656

Elastic » Elasticsearch » Version: 8.11.0

cpe:2.3:a:elastic:elasticsearch:8.11.0
Elastic » Elasticsearch » Version: 8.11.1

cpe:2.3:a:elastic:elasticsearch:8.11.1
Elastic » Elasticsearch » Version: 8.11.2

cpe:2.3:a:elastic:elasticsearch:8.11.2
Elastic » Elasticsearch » Version: 8.11.3

cpe:2.3:a:elastic:elasticsearch:8.11.3
Elastic » Elasticsearch » Version: 8.11.4

cpe:2.3:a:elastic:elasticsearch:8.11.4
Elastic » Elasticsearch » Version: 8.12.0

cpe:2.3:a:elastic:elasticsearch:8.12.0
Elastic » Elasticsearch » Version: 8.12.1

cpe:2.3:a:elastic:elasticsearch:8.12.1
Elastic » Elasticsearch » Version: 8.12.2

cpe:2.3:a:elastic:elasticsearch:8.12.2
Elastic » Elasticsearch » Version: 8.13.0

cpe:2.3:a:elastic:elasticsearch:8.13.0
Elastic » Elasticsearch » Version: 8.13.1

cpe:2.3:a:elastic:elasticsearch:8.13.1
Elastic » Elasticsearch » Version: 8.13.2

cpe:2.3:a:elastic:elasticsearch:8.13.2
Elastic » Elasticsearch » Version: 8.13.3

cpe:2.3:a:elastic:elasticsearch:8.13.3
Elastic » Elasticsearch » Version: 8.13.4

cpe:2.3:a:elastic:elasticsearch:8.13.4
Elastic » Elasticsearch » Version: 8.14.0

cpe:2.3:a:elastic:elasticsearch:8.14.0
Elastic » Elasticsearch » Version: 8.14.1

cpe:2.3:a:elastic:elasticsearch:8.14.1
Elastic » Elasticsearch » Version: 8.14.2

cpe:2.3:a:elastic:elasticsearch:8.14.2
Elastic » Elasticsearch » Version: 8.14.3

cpe:2.3:a:elastic:elasticsearch:8.14.3
Elastic » Elasticsearch » Version: 8.15.0

cpe:2.3:a:elastic:elasticsearch:8.15.0
Elastic » Elasticsearch » Version: 8.15.1

cpe:2.3:a:elastic:elasticsearch:8.15.1
Elastic » Elasticsearch » Version: 8.15.2

cpe:2.3:a:elastic:elasticsearch:8.15.2
Elastic » Elasticsearch » Version: 8.15.3

cpe:2.3:a:elastic:elasticsearch:8.15.3
Elastic » Elasticsearch » Version: 8.15.4

cpe:2.3:a:elastic:elasticsearch:8.15.4
Elastic » Elasticsearch » Version: 8.15.5

cpe:2.3:a:elastic:elasticsearch:8.15.5
Elastic » Elasticsearch » Version: 8.16.0

cpe:2.3:a:elastic:elasticsearch:8.16.0
Elastic » Elasticsearch » Version: 8.16.1

cpe:2.3:a:elastic:elasticsearch:8.16.1
Elastic » Elasticsearch » Version: 8.16.2

cpe:2.3:a:elastic:elasticsearch:8.16.2
Elastic » Elasticsearch » Version: 8.16.3

cpe:2.3:a:elastic:elasticsearch:8.16.3
Elastic » Elasticsearch » Version: 8.17.0

cpe:2.3:a:elastic:elasticsearch:8.17.0
Elastic » Elasticsearch » Version: 8.17.1

cpe:2.3:a:elastic:elasticsearch:8.17.1
Elastic » Elasticsearch » Version: 8.17.10

cpe:2.3:a:elastic:elasticsearch:8.17.10
Elastic » Elasticsearch » Version: 8.17.2

cpe:2.3:a:elastic:elasticsearch:8.17.2
Elastic » Elasticsearch » Version: 8.17.3

cpe:2.3:a:elastic:elasticsearch:8.17.3
Elastic » Elasticsearch » Version: 8.17.4

cpe:2.3:a:elastic:elasticsearch:8.17.4
Elastic » Elasticsearch » Version: 8.17.5

cpe:2.3:a:elastic:elasticsearch:8.17.5
Elastic » Elasticsearch » Version: 8.17.6

cpe:2.3:a:elastic:elasticsearch:8.17.6
Elastic » Elasticsearch » Version: 8.17.7

cpe:2.3:a:elastic:elasticsearch:8.17.7
Elastic » Elasticsearch » Version: 8.17.8

cpe:2.3:a:elastic:elasticsearch:8.17.8
Elastic » Elasticsearch » Version: 8.17.9

cpe:2.3:a:elastic:elasticsearch:8.17.9

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-72656

Products

Pricing

Contact Us