CVE-2026-72687

Name of the Vulnerable Software and Affected Versions Elasticsearch (affected versions not specified)

Description A flaw allows a low-privileged authenticated user to submit a small request containing a forged opaque identifier. The system decodes and deserializes this identifier before verifying its legitimacy. A size value within the identifier triggers a memory allocation that is not capped or monitored by memory-usage controls, leading to a fatal out-of-memory condition that terminates the node process and causes a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.