Elasticsearch: Twelve DoS Vulnerabilities Disclosed Together, One High Severity
Key findings • Twelve Elasticsearch vulnerabilities disclosed on August 13, 2026, primarily leading to Denial of Service. • A High severity vulnerability (CVE-2026-72642) impacts machine lear…
Key findings
- Twelve Elasticsearch vulnerabilities disclosed on August 13, 2026, primarily leading to Denial of Service.
- A High severity vulnerability (CVE-2026-72642) impacts machine learning model inference.
- Multiple CVEs stem from improper handling of user-supplied input causing excessive memory allocation.
- Uncontrolled recursion in Elasticsearch components is a recurring theme across several disclosed flaws.
- Vulnerabilities are exploitable by authenticated users with low-level privileges.
On August 13, 2026, Elastic disclosed a batch of twelve vulnerabilities affecting its Elasticsearch product. The vulnerabilities, all disclosed on the same day, primarily revolve around denial-of-service (DoS) conditions that can be triggered by authenticated users with low-level privileges. These flaws stem from improper validation of user-supplied input, leading to excessive memory allocation, uncontrolled recursion, or unbounded processing of data structures. The most severe of these, CVE-2026-72642, is rated High with a CVSSv3 score of 8.8, while the remaining eleven are rated Medium.
Several vulnerabilities are related to memory allocation issues. CVE-2026-72687, CVE-2026-72678, CVE-2026-72645, and CVE-2026-72656 all involve the Elasticsearch component improperly handling size values from user input, leading to excessive memory allocation and potential denial of service. Specifically, CVE-2026-72656, which affects ES|QL query processing, and CVE-2026-72645, which impacts search requests, are highlighted as examples of this memory allocation vulnerability.
Another significant theme among the disclosed CVEs is uncontrolled recursion. CVE-2026-72686, CVE-2026-72647, CVE-2026-72638, and CVE-2026-72636 all describe scenarios where recursive processing of crafted input without proper bounds leads to denial of service. CVE-2026-72647, affecting search requests, and CVE-2026-72636, impacting wildcard matching, are notable examples where deep nesting or extensive recursive operations exhaust system resources.
Further contributing to the denial of service conditions are flaws related to input processing and data structure handling. CVE-2026-72685 allows a low-privileged user to degrade indexing availability by submitting documents that occupy worker threads for disproportionate amounts of time. Similarly, CVE-2026-72683 enables an authenticated user to trigger a self-referential data structure that consumes excessive resources when processed. CVE-2026-72639 also contributes to DoS by not enforcing an upper bound on a user-supplied count for search highlighting, bypassing circuit breakers.
The most critical vulnerability, CVE-2026-72642, involves the native inference process for machine learning models. It allows a user with specific privileges to trigger a memory address computation using an unvalidated offset, potentially leading to memory corruption or denial of service.
Elastic has addressed these vulnerabilities through updates. Users are advised to consult the official Elastic security advisories for specific version information and patching details. The timely disclosure and patching of these vulnerabilities are crucial for maintaining the stability and security of Elasticsearch deployments. The concentration of these issues, primarily affecting authenticated users and leading to denial of service, underscores the importance of input validation and resource management in complex systems like Elasticsearch.
This batch of vulnerabilities highlights a recurring theme of improper handling of user-supplied input, particularly concerning memory allocation and recursive processing, which can be exploited by authenticated users to disrupt service availability. Users of Elasticsearch should prioritize applying the available patches to mitigate these risks.
The disclosures were made on August 13, 2026. All twelve CVEs were disclosed on the same day, indicating a coordinated release from Elastic.
Key findings include:
- Twelve vulnerabilities disclosed for Elasticsearch on August 13, 2026.
- Most CVEs are Medium severity, with one High severity (CVE-2026-72642).
- Primary impact is Denial of Service (DoS) due to excessive memory allocation or uncontrolled recursion.
- Vulnerabilities are exploitable by low-privileged authenticated users.
- Flaws are related to improper handling of user-supplied input in various components.
- CVE-2026-72642 affects machine learning model inference with a High severity rating.