{"id":"CVE-2026-72678","summary":"Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service","details":"Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to attempt an excessively large allocation. The resulting memory exhaustion raises a fatal error that terminates the Elasticsearch node process, causing a denial of service for the affected node and degrading cluster health. The defect is not volumetric, so a single request is sufficient regardless of the heap size configured on the target node.","aliases":["BIT-elasticsearch-2026-72678"],"modified":"2026-09-03T08:05:32.715150Z","published":"2026-08-13T19:11:02.710Z","related":["CGA-4c6w-727f-m634"],"database_specific":{"cna_assigner":"elastic","cwe_ids":["CWE-789"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72678.json","unresolved_ranges":[{"source":"AFFECTED_FIELD","extracted_events":[{"introduced":"8.19.0"},{"last_affected":"8.19.19"},{"introduced":"9.4.0"},{"last_affected":"9.4.4"},{"introduced":"9.5.0"},{"last_affected":"9.5.0"}]}]},"references":[{"type":"WEB","url":"https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-9-5-1-security-update-esa-2026-80/389507"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72678.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72678"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/elasticsearch","events":[{"introduced":"93788a8c2882eb5b606510680fac214cff1c7a22"},{"fixed":"91f5381ece296ddc32b554f997269478b9224af8"},{"introduced":"2e8528e92361c3399724226deaf2b46f933e925b"},{"fixed":"adc1f04ffdd393d1977990338d5512c5eaf1ce94"},{"introduced":"8d4246a64bc255212407b1b313fe402391299c88"},{"fixed":"0e1cdd500cb446f51b847d131747da3cc500eee1"}],"database_specific":{"cpe":"cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"8.19.0"},{"fixed":"8.19.20"},{"introduced":"9.4.0"},{"fixed":"9.4.5"},{"introduced":"9.5.0"},{"fixed":"9.5.1"}],"source":"CPE_RANGE"}}],"versions":["v9.5.0","v9.4.4","v8.19.19","v8.19.18","v9.4.3","v8.19.17","v8.19.16","v9.4.2","v9.4.1","v9.4.0","v8.19.15","v8.19.14","v8.19.13","v8.19.12","v8.19.11","v8.19.10","v8.19.9","v8.19.8","v8.19.7","v8.19.6","v8.19.5","v8.19.4","v8.19.3","v8.19.2","v8.19.1","v8.19.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72678.json","vanir_signatures_modified":"2026-09-03T08:05:32Z","vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["123981481255407045294348322935594806351","44204302243386940170311981959959639864","131420106978276354911612316684253233665","87658692873721293434045014145731391047","171639339474673894249490141151703449799","263194038508078032790587513132423641433","257929515943553399210416517578729308338","121625805403105533110683040990667235121","43884329338448479852302278361713519333","246201673227164427213009568950679993430","4709468299743023588656665672960441088","222632194900728927199489619294820731255","93468074782110413649383207684748418615","66157145909160175252111233287589933529","166255367629930891641033955460863451043","177811184578442322335368907027836724797","141930475752604767902217455204238841821","260772735535543718916890480775562065782","63093408138007908699464550848733117802","340007139969966153776593200509109541360","310774263480383056817102997580951176891","44430289872686780621890100318505480992","249150114831686621331448157157860930295","151605791150707541189836551182335007455","32457392160477534218776129706241005033","92731282093362661148757914604841322423","181233624261948057208386922751818839772"]},"id":"CVE-2026-72678-01150edc","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/TextFieldMapper.java"},"deprecated":false},{"deprecated":false,"digest":{"length":659,"function_hash":"174250500436844994847368292860406706308"},"id":"CVE-2026-72678-0216607f","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/test/java/org/elasticsearch/index/mapper/KeywordFieldTypeTests.java","function":"testTermQuery"}},{"signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/RoutingFieldMapper.java","function":"wildcardQuery"},"deprecated":false,"digest":{"length":923,"function_hash":"176210388332724284101918661733862504474"},"id":"CVE-2026-72678-04a86e17","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"x-pack/plugin/mapper-unsigned-long/src/main/java/org/elasticsearch/xpack/unsignedlong/UnsignedLongFieldMapper.java"},"deprecated":false,"digest":{"line_hashes":["82742223003007809130719283063788079890","97054664469949681794764827748394079157","257500183911231461750958994497335705178","244558200309964658969802151475467074559","97977900315528002241877010718378143116","184747353109276570942882175306552590692","156257138255232458547870543285685059694","282386597383733004097092473613964782956","105562053103106017467466968763459233361","137068903054708044967947032848373809261","273903888590585286472121500684132265238","200418661322210277042815684986028129704"],"threshold":0.9},"id":"CVE-2026-72678-062f006e"},{"digest":{"function_hash":"325020845562176106021334253180547587686","length":431},"id":"CVE-2026-72678-071dcd9e","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/flattened/FlattenedFieldMapper.java","function":"termQuery"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/RoutingFieldMapper.java","function":"prefixQuery"},"deprecated":false,"digest":{"function_hash":"81214034768093287171274201318042390497","length":531},"id":"CVE-2026-72678-074315c9","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/RoutingFieldMapper.java","function":"termQuery"},"deprecated":false,"digest":{"function_hash":"178237671650821853885719085027465546829","length":237},"id":"CVE-2026-72678-09927873","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"149550529654412434166062323113154329261","length":572},"id":"CVE-2026-72678-09a94ac1","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/test/java/org/elasticsearch/index/mapper/RoutingFieldTypeTests.java","function":"testPrefixQueryDocValues"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/IpFieldMapper.java"},"deprecated":false,"digest":{"line_hashes":["116179265180460411511287659751430043905","183869889035475120330587826469706880288","183254064914714577952265507825565856541","288524937615991167292240964761055263194","107196119584515141966425777245320598139","7149948191255916173302059401639353781","321941973744353851176032724674019842959","216191671378242106094924193463667528661","100594890366136568132274633650905676454","293072881507757080613530575730021766738","292250961461361605217413280980481397551"],"threshold":0.9},"id":"CVE-2026-72678-09db9ffb"},{"source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/RoutingFieldMapper.java","function":"fuzzyQuery"},"deprecated":false,"digest":{"function_hash":"134396424628097769735244509765610427325","length":495},"id":"CVE-2026-72678-10563ebd","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/lucene/queries/SortedNumericDocValuesRangeQuery.java","function":"newRangeQuery"},"deprecated":false,"digest":{"function_hash":"272954859314647263123909975443144777653","length":241},"id":"CVE-2026-72678-1272aa88"},{"target":{"function":"testPrefixQueryDocValuesOnly","file":"server/src/test/java/org/elasticsearch/index/mapper/TextFieldTypeTests.java"},"deprecated":false,"digest":{"function_hash":"22848489962912717395125876906025266524","length":1193},"id":"CVE-2026-72678-151b04b5","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1"},{"deprecated":false,"digest":{"line_hashes":["283190670438501987514727838726815920477","139872482520600089094968553951135983484","244928736363048457427079246025589015191"],"threshold":0.9},"id":"CVE-2026-72678-15fc2a3d","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94","target":{"file":"server/src/test/java/org/elasticsearch/search/fetch/subphase/highlight/PlainHighlighterTests.java"}},{"signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/test/java/org/elasticsearch/index/mapper/RoutingFieldTypeTests.java","function":"testFuzzyQueryDocValues"},"deprecated":false,"digest":{"function_hash":"257272680372827337911810308734804520590","length":679},"id":"CVE-2026-72678-168e3468","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["253214962327687458697293851744228962674","22023628707689431355101791818041007524","103414799870051875915477190718512843255","285655303386366806467722352533439983781","281317724399236279359610982736862100391","72765239727678662142591661805975028123","321961970241445156437220288130172815256","256570673388934670349670142206998655092","50143909241429619877377736126357645543","257672686499160816798413107549965643487","78784688770878958693649214948236137942","66277723380230967401855313766502187710","23116884085994545212953255560043990958","268734295862612408806991514872300964797","338386206661611106278220748744954426618","276364368722583032338527935409264475231","306415572943709537886650059109011274849","104868903728940384329883833790325114941","87218321176994229858787086526465891531","269037601145664656759293858408551900801","155404033901021192223258963494267881403","70443580641142454420341853915231025136","145548667386584198794410340487029487426","16632652845925791443414183954272482765","164212823380778918794441751415668463777"],"threshold":0.9},"id":"CVE-2026-72678-16c45f44","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/lucene/queries/SortedNumericDocValuesRangeQuery.java"}},{"digest":{"threshold":0.9,"line_hashes":["274992522183023089218438232542968799396","173940322934652454134273154560064437339","8325208987467100328325686091060413882","214241318122311603964757613342466207407","69839042837717635513155240933728727573","2512226894821918829727924849463652483","9805650345859792425627637847171710478","191335708322584984445492351229876384736","245003049968537080247767953908754356796","275080994985585732646642964549618530827","33967631179385688579877725247600928755","9769819747745501990961937553327230237","297303162048253147320488859493072619561","159894983643915527827708398705454091568"]},"id":"CVE-2026-72678-22c3b712","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/test/java/org/elasticsearch/index/mapper/flattened/KeyedFlattenedFieldTypeTests.java"},"deprecated":false},{"source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"modules/mapper-extras/src/test/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldTypeTests.java","function":"testRegexpQueryDocValuesOnly"},"deprecated":false,"digest":{"function_hash":"81241544047405606522632003424135112527","length":696},"id":"CVE-2026-72678-2532a7f5","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"modules/mapper-extras/src/test/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldTypeTests.java","function":"testRegexpQueryDocValuesOnlyCaseInsensitive"},"deprecated":false,"digest":{"length":438,"function_hash":"17814591615813564355775428497036990414"},"id":"CVE-2026-72678-277d3720"},{"target":{"function":"rangeQuery","file":"x-pack/plugin/mapper-unsigned-long/src/main/java/org/elasticsearch/xpack/unsignedlong/UnsignedLongFieldMapper.java"},"deprecated":false,"digest":{"function_hash":"22677521168560083410445063530987624293","length":833},"id":"CVE-2026-72678-290f753a","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1"},{"source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/TextFieldMapper.java","function":"wildcardQuery"},"deprecated":false,"digest":{"length":841,"function_hash":"194919762179290610046683685362069497927"},"id":"CVE-2026-72678-2bd338e5","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"function":"prefixQuery","file":"server/src/main/java/org/elasticsearch/index/mapper/KeywordFieldMapper.java"},"deprecated":false,"digest":{"function_hash":"233961644639584846741591562128438196313","length":681},"id":"CVE-2026-72678-2d9d1789","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"modules/mapper-extras/src/test/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldTypeTests.java"},"deprecated":false,"digest":{"line_hashes":["231262441738846545870675035531340178098","27399529362196089291737377336698210738","198184034113742596100414311000042275832","217001668783895066054904409177940917532","94522778889656549922641393574861382865","321507534254288945536275445095655200460","300921655751101597798721670618284354982","155571433615047140908350531201695203697","54825427795682146603350391377607376958","234000679770396912599137589384415616213","190529291644002113512891593134710772370","155108210879745388207633484589252048438","49600389875303787654084238875891266222","249354697765847400376185101600203317289","69448476286554083668803952821093153272","194959586781376324295467668308655596870","250789472420568115942738962292962370464","241039098149805697323097252044510645959","247727200726109314425285644352142597653","158079880273341355959410624973311274496","30840037820813559649522620767002266740","120656659808709034875873621442904316345","79621935499872818513590095040841154488","204951165984387538508856597169969605783"],"threshold":0.9},"id":"CVE-2026-72678-31eba752"},{"signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/lucene/queries/SortedNumericDocValuesRangeQuery.java","function":"scorerSupplier"},"deprecated":false,"digest":{"function_hash":"117684187083423012108085472617175999469","length":1054},"id":"CVE-2026-72678-36a1e26e","signature_type":"Function"},{"digest":{"function_hash":"324443554272074113463661193367571699701","length":1199},"id":"CVE-2026-72678-3741b9fa","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/test/java/org/elasticsearch/index/mapper/TextFieldTypeTests.java","function":"testWildcardQueryDocValuesOnly"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94","target":{"function":"setupParser","file":"server/src/main/java/org/elasticsearch/search/fetch/subphase/highlight/AbstractHighlighterBuilder.java"},"deprecated":false,"digest":{"length":2369,"function_hash":"35973537492193988444530376691395407843"},"id":"CVE-2026-72678-3749bff4"},{"digest":{"function_hash":"120690981007339764569187458309554373085","length":621},"id":"CVE-2026-72678-40a6e6f0","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/test/java/org/elasticsearch/index/mapper/RoutingFieldTypeTests.java","function":"testWildcardQueryDocValues"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"282582380564287413725776763366208666892","length":688},"id":"CVE-2026-72678-4af7f0a7","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/RoutingFieldMapper.java","function":"regexpQuery"}},{"deprecated":false,"digest":{"length":826,"function_hash":"321311134070149240783824711489285336995"},"id":"CVE-2026-72678-4db2c116","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/KeywordFieldMapper.java","function":"fuzzyQuery"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/test/java/org/elasticsearch/index/mapper/RoutingFieldTypeTests.java"},"deprecated":false,"digest":{"line_hashes":["158299155865954798697471123488657809952","290438277732749345471434798615555663803","65611874746019749218585859063673183557","36836748939579765223185228370491162810","157503281285541764074250705567810892175","324012272081145999964910665562408096526","291048643231746917545012768600086883939","50177173231707158154295888688781724851","310063041459095520606022448796695505518","46347876943104746414707568975190743135","101830628042537755082635755808772036931","180732612847602565686147651548021054305","230196827303167968907456411013655669081","16440820031643057168808298047206059493","28096251493121644722945922633513840969","131576468658413583282683684796029728846","220879638278342704321163095617857131062","120721494403118825456860774670731357748","33721305282351764979432246707433383021","216186493776396525552167392184644277853"],"threshold":0.9},"id":"CVE-2026-72678-4f05bc53"},{"deprecated":false,"digest":{"function_hash":"299069382151578024839795989994333078958","length":865},"id":"CVE-2026-72678-519d0876","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"modules/mapper-extras/src/main/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldMapper.java","function":"regexpQuery"}},{"target":{"file":"server/src/main/java/org/elasticsearch/search/fetch/subphase/highlight/HighlightBuilder.java"},"deprecated":false,"digest":{"line_hashes":["114508176030696626539066047296433779214","43384607500169746049581282043376952148","283563727296098110195444588655154165811","277031765205288332698033581440269116720","187407052376657667672985622362187421922","90126549817761157374395826113896432271","62431126033836515299954878706677890458","276372619117036678140958072933552714348","34204804071724460000309539643270206424","178874689487166837173458238589286447776"],"threshold":0.9},"id":"CVE-2026-72678-56785d56","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94"},{"target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/TextFieldMapper.java","function":"prefixQuery"},"deprecated":false,"digest":{"function_hash":"13867023443941602265102682281667894052","length":991},"id":"CVE-2026-72678-5c1e80e6","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/TextFieldMapper.java","function":"regexpQuery"},"deprecated":false,"digest":{"function_hash":"299069382151578024839795989994333078958","length":865},"id":"CVE-2026-72678-5dc67e7e"},{"deprecated":false,"digest":{"function_hash":"276877686016664170943547964031779829624","length":268},"id":"CVE-2026-72678-6225ace6","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"x-pack/plugin/downsample/src/main/java/org/elasticsearch/xpack/downsample/DownsampleShardIndexer.java","function":"createQuery"}},{"target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/TextFieldMapper.java","function":"termQuery"},"deprecated":false,"digest":{"length":365,"function_hash":"28901960886106187974505386211677064580"},"id":"CVE-2026-72678-67e6dec8","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1"},{"deprecated":false,"digest":{"function_hash":"74600334261879604741521313242640339568","length":4662},"id":"CVE-2026-72678-687797ed","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94","target":{"file":"server/src/main/java/org/elasticsearch/search/fetch/subphase/highlight/PlainHighlighter.java","function":"highlight"}},{"digest":{"function_hash":"249829975215623040026717820971717253665","length":519},"id":"CVE-2026-72678-6e06ae91","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/test/java/org/elasticsearch/index/mapper/flattened/KeyedFlattenedFieldTypeTests.java","function":"testTermsQueryWithSortedSetDocValuesOnly"},"deprecated":false},{"digest":{"function_hash":"10160088286724545746756661846724288313","length":176},"id":"CVE-2026-72678-6e669937","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94","target":{"file":"server/src/test/java/org/elasticsearch/search/fetch/subphase/highlight/HighlightBuilderTests.java","function":"getFieldType"},"deprecated":false},{"digest":{"function_hash":"209510722116369156248077758238561801457","length":1047},"id":"CVE-2026-72678-6e90a2f5","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/KeywordFieldMapper.java","function":"wildcardQuery"},"deprecated":false},{"target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/KeywordFieldMapper.java","function":"regexpQuery"},"deprecated":false,"digest":{"function_hash":"175608336659589308220602687675562161499","length":934},"id":"CVE-2026-72678-7633cec2","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1"},{"deprecated":false,"digest":{"function_hash":"237774244707984564262143441354961075139","length":255},"id":"CVE-2026-72678-7e892fe7","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/LegacyTypeFieldMapper.java","function":"rangeQuery"}},{"source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"modules/mapper-extras/src/main/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldMapper.java"},"deprecated":false,"digest":{"line_hashes":["123981481255407045294348322935594806351","44204302243386940170311981959959639864","131420106978276354911612316684253233665","87658692873721293434045014145731391047","89565961111605722967981568192712857692","263194038508078032790587513132423641433","257929515943553399210416517578729308338","121625805403105533110683040990667235121","43884329338448479852302278361713519333","246201673227164427213009568950679993430","4709468299743023588656665672960441088","222632194900728927199489619294820731255","93468074782110413649383207684748418615","66157145909160175252111233287589933529","166255367629930891641033955460863451043","177811184578442322335368907027836724797","141930475752604767902217455204238841821","260772735535543718916890480775562065782","63093408138007908699464550848733117802","340007139969966153776593200509109541360","310774263480383056817102997580951176891","44430289872686780621890100318505480992","249150114831686621331448157157860930295","151605791150707541189836551182335007455","32457392160477534218776129706241005033","92731282093362661148757914604841322423","181233624261948057208386922751818839772"],"threshold":0.9},"id":"CVE-2026-72678-831dc26d","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["170904724797256563137962626779816612009","280165975533075985479552475709246058636","127837524543965964660610569377961201648","258594428196649702519404259631378281855","196835288977964319153200621397593850645","70851472792616671836488488696598868211","195245424061901508978577495681900861772","136108197221795826649413971642009801732","138042963707836004098059840579622935110","205710732769761493748097307333896728553","213670480756579350315852425204600197771","322235901232772409215262239603690118995"],"threshold":0.9},"id":"CVE-2026-72678-84264732","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"x-pack/plugin/downsample/src/main/java/org/elasticsearch/xpack/downsample/DownsampleShardIndexer.java"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"modules/mapper-extras/src/test/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldTypeTests.java","function":"testWildcardQueryDocValuesOnly"},"deprecated":false,"digest":{"function_hash":"214169512007379416294261385373220952572","length":790},"id":"CVE-2026-72678-8a94d346"},{"digest":{"function_hash":"194919762179290610046683685362069497927","length":841},"id":"CVE-2026-72678-8d97e4ca","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"modules/mapper-extras/src/main/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldMapper.java","function":"wildcardQuery"},"deprecated":false},{"source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/KeywordFieldMapper.java"},"deprecated":false,"digest":{"line_hashes":["123981481255407045294348322935594806351","44204302243386940170311981959959639864","131420106978276354911612316684253233665","313205144234086949387619874115845745234","147247772808727365000835392162881565883","49506963071760563708494909117891220512","257929515943553399210416517578729308338","121625805403105533110683040990667235121","43884329338448479852302278361713519333","195423170977350645124386507709302851717","6594204483920868680222172931454387145","59573237293865752792567459657781784598","11001044368328988540960275163462814913","160004791578906769873715620300583182282","187259691234723460728062496940442381107","255995195478938222048046645820638534837","119614628232425111046575880743386686491","27350422529721370696073172804890176956","27714745724213017792040830682199970281","223818959677235182402223183357554728433","40703751645971653828573386837157996108","66157145909160175252111233287589933529","166255367629930891641033955460863451043","177811184578442322335368907027836724797","141930475752604767902217455204238841821","283076309056458468973229571223380378688","43261489784283666375604973324136613284","66157145909160175252111233287589933529","166255367629930891641033955460863451043","177811184578442322335368907027836724797","141930475752604767902217455204238841821","245600864787210620244623774654315731212","243133217007217528025747044037055171564","340007139969966153776593200509109541360","310774263480383056817102997580951176891","44430289872686780621890100318505480992","337045705982292508207337481184261738187","151605791150707541189836551182335007455","32457392160477534218776129706241005033","92731282093362661148757914604841322423","52610850777785354492649522406690795373"],"threshold":0.9},"id":"CVE-2026-72678-8e026942","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-72678-8f3e26dd","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"modules/mapper-extras/src/main/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldMapper.java","function":"prefixQuery"},"deprecated":false,"digest":{"function_hash":"331027999623847724383311912003031096866","length":586}},{"target":{"function":"convertToDocValuesQuery","file":"server/src/main/java/org/elasticsearch/index/mapper/IpFieldMapper.java"},"deprecated":false,"digest":{"length":437,"function_hash":"154671420770954245140816662867195943375"},"id":"CVE-2026-72678-93ead5c0","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1"},{"deprecated":false,"digest":{"line_hashes":["133411462927699084585462261659984105017","144282983868821857195851086506132526755","7714489732271407416039058708000131745","322579701948388492751071998550408367914","170682764861092642277550262568380267753","114852989775677865381263859241103490197","21331596509338171835985702646533297062","335129060167704794066766886741649947118","191358222342633768383728661702196220724","21118912815188888846588019812225636612","234228620740591874404512777291940817724","11001044368328988540960275163462814913"],"threshold":0.9},"id":"CVE-2026-72678-9553c100","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/LegacyTypeFieldMapper.java"}},{"deprecated":false,"digest":{"line_hashes":["130192812032915568189929366428112074279","338587668112843751875004607897056457244","311636223832287298418351940618914661904","14559433973571236327103093772803942734","81766092491860980139880041074416541030","83778004218823664808743686188872036723","217672029278899031516016760140755058444"],"threshold":0.9},"id":"CVE-2026-72678-9734acfc","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94","target":{"file":"server/src/main/java/org/elasticsearch/rest/action/search/SearchCapabilities.java"}},{"digest":{"function_hash":"233491607930649407634984525965378032760","length":367},"id":"CVE-2026-72678-a408b480","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/KeywordFieldMapper.java","function":"termQuery"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"modules/mapper-extras/src/test/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldTypeTests.java","function":"testPrefixQueryDocValuesOnly"},"deprecated":false,"digest":{"function_hash":"177153981493023677960767003224584378481","length":739},"id":"CVE-2026-72678-aa106806","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["288953345354854077790001801438399492168","164455731617607039247608044388178637948","231067652914584020538293949485143581915","202697150930523272718665946242585243548","338565860898664850095001390107933850432","111632602778036892811214812286385655501","57622998469661813808578668317100624789","81073906019052243163910379736658572471","240004611505933661359316334084333313845","204276024962536650034120696864044039326"],"threshold":0.9},"id":"CVE-2026-72678-ad557ddf","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/flattened/FlattenedFieldMapper.java"}},{"digest":{"line_hashes":["243868588130949656791143692081236563864","311505216586199373294314499230294889565","23300629379259170631342652985157100415","99779525804820300359777388439313924719","124392759507223488964887386448798184793","57056074566821104672192600168236166604","183428232184500482658775793061523078930"],"threshold":0.9},"id":"CVE-2026-72678-bd63b83e","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94","target":{"file":"server/src/main/java/org/elasticsearch/search/fetch/subphase/highlight/AbstractHighlighterBuilder.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/test/java/org/elasticsearch/index/mapper/KeywordFieldTypeTests.java","function":"testRangeQuery"},"deprecated":false,"digest":{"length":888,"function_hash":"268054438902092884610470779239085935873"},"id":"CVE-2026-72678-c354a3d8"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/test/java/org/elasticsearch/index/mapper/KeywordFieldTypeTests.java"},"deprecated":false,"digest":{"line_hashes":["262570396947974807532398923668494971644","58389485591587880872375759108381094506","304512246337602472263022864599860950444","184368045976268345340856868536522530760","75487787420854223013415960993162458777","330915427690360321322798336727709265916","151589742277712624771827960488070133965","302551852374250195236161664941671832879","206237639466547587142448991307376531594","38406818615248637556183406942138956552","102097723662782091672328944319414049554","150369593505711894281186652804139377873","47511948615989919507961726401213967526","135702458142223632116841990522498485363","226375727676935993795356268134213973329","179625523733299288739937340896263074776","25250820851756373207480287528407707286","333239537134558438085664713861509911193","48126198197286454736570800749363694390","143269063544844444882941092853866730073"],"threshold":0.9},"id":"CVE-2026-72678-c990c435"},{"id":"CVE-2026-72678-ca3692e7","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94","target":{"file":"server/src/test/java/org/elasticsearch/search/fetch/subphase/highlight/HighlightBuilderTests.java"},"deprecated":false,"digest":{"line_hashes":["122639132757664986803138175691671001655","335892283999867396276535502941166644649","252845685254806679929754126735709659653","70459544080609156892578956654685198979","288350301639674802567568120843372854348","128879439556083118790804565740578695567","183568503689704087885138164738553210791","315988264130765396628199666193426980549","110105306531665817097053229432225710351","108886619290626151118397149603734671098","68900764452827513161409585113073530589","109699481272201296627752008736891181922","89552474233322494405147063649180198152","243794874480578150177830085733756836217","128936352400535787295390066296206280301","168193967744077208144892951303807415035","32485489507345202777470620624306770167","82468793747458534960176489784612968344","95431536162858288727547312167888083055","79895802567313409968279279144916310561","109983373614664327492018760324106301607","254164139643632659290414288579740637195","218911482828271878345863242741149783938","290149128642774742559654272690374710990","129649976829885946269329561068451864187","271521553609249011929656203339955131993","116967678018103273313850160203491775016","34507466461561024444180968955125864688","149539466270008484339757108260134471872","241540141246676079432554907112288153733","247281622777097759942516432384261889326","8682106367820934505412234917026602498","258599880353756871245323998211345504441","140682565192181975671989624265695960587","100268892565605616091333444189761449681","214950598829781998119271592022997186976","200550104524719405385075838124186899375","313720121068230248463194804287647092807","188167255630204728049901172366742944889","197051329735330186721065881872811534640","246392715163119707808625433035684232434","127945619089996738346525337879859203179","136702270964155933380398036066653195170"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"90624619653879529393067550177924572338","length":2265},"id":"CVE-2026-72678-d7e090a8","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/lucene/queries/SortedNumericDocValuesRangeQuery.java","function":"createWeight"}},{"id":"CVE-2026-72678-dae1a278","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/RoutingFieldMapper.java"},"deprecated":false,"digest":{"line_hashes":["222619651141096478816465300519312054261","296182117205335300120275499128574113355","238799324243410438130683247710717122677","201449822339388892733141941969550197131","200960559430588746266726625738369495186","134609492323651711647577697817611088216","317960371168638866971462807031630211171","317443264255626593146889852473241092770","20880998077061114936653533804355710463","250279444475820896094192118818139636127","218638487241652355389519182811952131782","316490706737803366158794695719834745703","30470268583374464618522706524336046485","160004791578906769873715620300583182282","187259691234723460728062496940442381107","255995195478938222048046645820638534837","119614628232425111046575880743386686491","168711246212498559946182872274862826053","27714745724213017792040830682199970281","223818959677235182402223183357554728433","40703751645971653828573386837157996108","66157145909160175252111233287589933529","166255367629930891641033955460863451043","177811184578442322335368907027836724797","141930475752604767902217455204238841821","283076309056458468973229571223380378688","43261489784283666375604973324136613284","340007139969966153776593200509109541360","310774263480383056817102997580951176891","44430289872686780621890100318505480992","170236523216932468148844818179329159249","151605791150707541189836551182335007455","32457392160477534218776129706241005033","92731282093362661148757914604841322423","153963534307217003766364156780935899396"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"186492591955110081095185334864085897708","length":674},"id":"CVE-2026-72678-dc0a4f96","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94","target":{"file":"server/src/main/java/org/elasticsearch/search/fetch/subphase/highlight/HighlightBuilder.java","function":"build"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/test/java/org/elasticsearch/index/mapper/TextFieldTypeTests.java","function":"testRegexpQueryDocValuesOnly"},"deprecated":false,"digest":{"function_hash":"100123407710388145007772192562942474536","length":1001},"id":"CVE-2026-72678-dda50a9c"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"function":"testTermQueryWithSortedSetDocValuesOnly","file":"server/src/test/java/org/elasticsearch/index/mapper/flattened/KeyedFlattenedFieldTypeTests.java"},"deprecated":false,"digest":{"function_hash":"110066380476197981234191692838836179556","length":381},"id":"CVE-2026-72678-e4312115"},{"digest":{"function_hash":"50460798663850937323875144151113267593","length":3586},"id":"CVE-2026-72678-e5c86fee","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94","target":{"file":"server/src/test/java/org/elasticsearch/search/fetch/subphase/highlight/HighlightBuilderTests.java","function":"testBuildSearchContextHighlight"},"deprecated":false},{"digest":{"function_hash":"305869188867308104033177319593392890753","length":130},"id":"CVE-2026-72678-eb2280ed","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"function":"termQuery","file":"server/src/main/java/org/elasticsearch/index/mapper/LegacyTypeFieldMapper.java"},"deprecated":false},{"source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/RoutingFieldMapper.java","function":"rangeQuery"},"deprecated":false,"digest":{"function_hash":"115742967990331344156763366785857507577","length":386},"id":"CVE-2026-72678-eff3bbc1","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/KeywordFieldMapper.java","function":"rangeQuery"},"deprecated":false,"digest":{"function_hash":"6775036207659108583463640655473363445","length":703},"id":"CVE-2026-72678-f0c19f16","signature_type":"Function"},{"target":{"function":"testRegexpQueryDocValuesOnlyCaseInsensitive","file":"server/src/test/java/org/elasticsearch/index/mapper/KeywordFieldTypeTests.java"},"deprecated":false,"digest":{"length":633,"function_hash":"103296355740687260756968839897573540889"},"id":"CVE-2026-72678-f32b7780","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1"},{"id":"CVE-2026-72678-f45060d1","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/test/java/org/elasticsearch/index/mapper/TextFieldTypeTests.java","function":"testRegexpQueryDocValuesOnlyCaseInsensitive"},"deprecated":false,"digest":{"function_hash":"139422809193726721648672856390622725390","length":464}},{"deprecated":false,"digest":{"line_hashes":["165280306443633048203347587503547778400","321507534254288945536275445095655200460","300921655751101597798721670618284354982","155571433615047140908350531201695203697","181185420139498530760645911740791471016","291933034616665983145509819624651375727","103648551761629172249178805342556366436","212289285374773232109826813432332934643","174122518808758360809701298455673638129","231925375722152521712669883444083454276","59608858761966757754123861669802975764","31299853657681819389012091619069310858","208638741119865337845046732038648000108","233827295439142928885418317596515715521","231304210162663406191492666298087060636","35355056532148979594233188880812492291","300317874516414122381985658933917713929","113169603910002188175335785810814481154","99639714575822838293690238841039221538","109205136646485806255675095577276894279"],"threshold":0.9},"id":"CVE-2026-72678-f69dc4df","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/test/java/org/elasticsearch/index/mapper/TextFieldTypeTests.java"}},{"digest":{"line_hashes":["250502453778712768962053518703255093608","293745187741608286289486472330502044902","92285933861987769382932879499624280339","48848052402887098574079705828368727963","180954780310110417851376237840132855867","265701660666103015958674140349152633739","219483656979539974598819100907886798376"],"threshold":0.9},"id":"CVE-2026-72678-f6f0ec86","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94","target":{"file":"server/src/main/java/org/elasticsearch/search/fetch/subphase/highlight/PlainHighlighter.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"229509955456560670147334768291738740827","length":382},"id":"CVE-2026-72678-fcad9667","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"modules/mapper-extras/src/main/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldMapper.java","function":"termQuery"}},{"deprecated":false,"digest":{"function_hash":"112299228529160377132220233230014009356","length":912},"id":"CVE-2026-72678-fd811cae","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1","target":{"file":"server/src/main/java/org/elasticsearch/index/mapper/KeywordFieldMapper.java","function":"normalizedWildcardQuery"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}