CVE-2026-72656
Description
A flaw was found in Elasticsearch. An authenticated user, by submitting a specially crafted ES|QL query, could trigger an unbounded allocation of heap memory. This excessive memory consumption exhausts the available resources on the receiving node, leading to a denial of service (DoS) condition where the node becomes unavailable.
Statement
A memory allocation flaw exists in Elasticsearch's ES|QL query processing engine. When evaluating a specially crafted ES|QL query, the engine fails to enforce upper bounds on memory allocation requests, triggering unbounded heap consumption. An authenticated remote attacker can exploit this issue by submitting malformed queries to exhaust the receiving node's heap memory, causing node instability or service crashes, posing an Important impact to availability.
Mitigation
Restrict ES|QL query permissions using Elasticsearch role-based access control (RBAC) so that only trusted users can submit queries. Additionally, configure request circuit breakers (`indices.breaker.request.limit`) to restrict maximum memory usage per query execution.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Memory)
Not controlling memory allocation can result in a request for too much system memory, possibly leading to a crash of the application due to out-of-memory conditions, or the consumption of a large amount of memory on the system.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
