CVE WatchAug 13, 2026

CVE-2026-72684

A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user

CVSS

6.5

Medium

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Aug 13, 2026 · Last modified: Aug 13, 2026 · CWE-770

EPSS · 30d

Not enough EPSS history yet.

Technical description

A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the scope of the existing memory accounting controls that were intended to constrain it. The resulting out-of-memory condition is fatal and terminates the affected node process, causing a denial of service.

Official references

discuss.elastic.cohttps://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-76/389508

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-198305.3 MED

—

———A vulnerability was found in TRENDnet TEW-816DRM GURNC4.OT182B-C-TN-R1B028-US.EN. This impacts an unknown function of the file /etc/bftpd.conf of the component bftpd. The manipulation of the argument USERLIMIT_GLOBAL results in allocation of resources. It is possible to launch the attack remotely. This vulnerability only affects products that are no longer supported by the maintainer.4h CVE-2026-728386.5 MED

—

———FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk space and cause service unavailability.8h CVE-2026-196175.5 MED

—

———A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager (LVM) metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the metadata to crash. This vulnerability results in a Denial of Service (DoS) for affected systems.6h CVE-2026-568627.5 HIG

—

———Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.4h CVE-2026-568597.5 HIG

—

———Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.4h CVE-2026-568537.5 HIG

—

———When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.4h