CVE-2026-72685

MediumCVSS 4.3/10Last modified Sep 1, 2026

Description

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the availability of indexing operations on the affected node.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-407

Affected software

No affected versions have been published.

Timeline

Published: Aug 13, 2026
Last modified: Sep 1, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-726866.5A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single request containing a crafted user-supplied input. A sp CVE-2026-726876.5A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. E CVE-2026-726887.5A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbit CVE-2026-726897.5A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to CVE-2026-72692.4A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected is an unknown function of the file /index.php?CVE-2026-726907.1An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent man CVE-2026-726917.5An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTE CVE-2026-726927.5A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibl CVE-2026-726937.8`openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the docu CVE-2026-726947.1A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker CVE-2026-726958.1Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile() that allows authenticated users with media mana CVE-2026-726968.4Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() that allows local attackers to overwrit