CVE-2026-72678
- Source
- https://cve.org/CVERecord?id=CVE-2026-72678
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72678.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-72678
- Aliases
- Downstream
- Related
- Published
- 2026-08-13T19:11:02Z
- Modified
- 2026-09-03T08:05:32Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service
- Details
-
Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to attempt an excessively large allocation. The resulting memory exhaustion raises a fatal error that terminates the Elasticsearch node process, causing a denial of service for the affected node and degrading cluster health. The defect is not volumetric, so a single request is sufficient regardless of the heap size configured on the target node.
- Database specific
{ "cna_assigner": "elastic", "cwe_ids": [ "CWE-789" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72678.json", "unresolved_ranges": [ { "extracted_events": [ { "introduced": "8.19.0" }, { "last_affected": "8.19.19" }, { "introduced": "9.4.0" }, { "last_affected": "9.4.4" }, { "introduced": "9.5.0" }, { "last_affected": "9.5.0" } ], "source": "AFFECTED_FIELD" } ] }- References
Affected packages
Git / github.com/elastic/elasticsearch
Affected ranges
- Type
- GIT
- Repo
- https://github.com/elastic/elasticsearch
- Events
- Database specific
-
Show details
{ "cpe": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*", "extracted_events": [ { "introduced": "8.19.0" }, { "fixed": "8.19.20" }, { "introduced": "9.4.0" }, { "fixed": "9.4.5" }, { "introduced": "9.5.0" }, { "fixed": "9.5.1" } ], "source": "CPE_RANGE" }
Affected versions
v8.*
v8.19.0
v8.19.1
v8.19.10
v8.19.11
v8.19.12
v8.19.13
v8.19.14
v8.19.15
v8.19.16
v8.19.17
v8.19.18
v8.19.19
v8.19.2
v8.19.3
v8.19.4
v8.19.5
v8.19.6
v8.19.7
v8.19.8
v8.19.9
v9.*
v9.4.0
v9.4.1
v9.4.2
v9.4.3
v9.4.4
v9.5.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72678.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"123981481255407045294348322935594806351",
"44204302243386940170311981959959639864",
"131420106978276354911612316684253233665",
"87658692873721293434045014145731391047",
"171639339474673894249490141151703449799",
"263194038508078032790587513132423641433",
"257929515943553399210416517578729308338",
"121625805403105533110683040990667235121",
"43884329338448479852302278361713519333",
"246201673227164427213009568950679993430",
"4709468299743023588656665672960441088",
"222632194900728927199489619294820731255",
"93468074782110413649383207684748418615",
"66157145909160175252111233287589933529",
"166255367629930891641033955460863451043",
"177811184578442322335368907027836724797",
"141930475752604767902217455204238841821",
"260772735535543718916890480775562065782",
"63093408138007908699464550848733117802",
"340007139969966153776593200509109541360",
"310774263480383056817102997580951176891",
"44430289872686780621890100318505480992",
"249150114831686621331448157157860930295",
"151605791150707541189836551182335007455",
"32457392160477534218776129706241005033",
"92731282093362661148757914604841322423",
"181233624261948057208386922751818839772"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-01150edc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/TextFieldMapper.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "174250500436844994847368292860406706308",
"length": 659
},
"id": "CVE-2026-72678-0216607f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/test/java/org/elasticsearch/index/mapper/KeywordFieldTypeTests.java",
"function": "testTermQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "176210388332724284101918661733862504474",
"length": 923
},
"id": "CVE-2026-72678-04a86e17",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/RoutingFieldMapper.java",
"function": "wildcardQuery"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"82742223003007809130719283063788079890",
"97054664469949681794764827748394079157",
"257500183911231461750958994497335705178",
"244558200309964658969802151475467074559",
"97977900315528002241877010718378143116",
"184747353109276570942882175306552590692",
"156257138255232458547870543285685059694",
"282386597383733004097092473613964782956",
"105562053103106017467466968763459233361",
"137068903054708044967947032848373809261",
"273903888590585286472121500684132265238",
"200418661322210277042815684986028129704"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-062f006e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "x-pack/plugin/mapper-unsigned-long/src/main/java/org/elasticsearch/xpack/unsignedlong/UnsignedLongFieldMapper.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "325020845562176106021334253180547587686",
"length": 431
},
"id": "CVE-2026-72678-071dcd9e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/flattened/FlattenedFieldMapper.java",
"function": "termQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "81214034768093287171274201318042390497",
"length": 531
},
"id": "CVE-2026-72678-074315c9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/RoutingFieldMapper.java",
"function": "prefixQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "178237671650821853885719085027465546829",
"length": 237
},
"id": "CVE-2026-72678-09927873",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/RoutingFieldMapper.java",
"function": "termQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "149550529654412434166062323113154329261",
"length": 572
},
"id": "CVE-2026-72678-09a94ac1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/test/java/org/elasticsearch/index/mapper/RoutingFieldTypeTests.java",
"function": "testPrefixQueryDocValues"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"116179265180460411511287659751430043905",
"183869889035475120330587826469706880288",
"183254064914714577952265507825565856541",
"288524937615991167292240964761055263194",
"107196119584515141966425777245320598139",
"7149948191255916173302059401639353781",
"321941973744353851176032724674019842959",
"216191671378242106094924193463667528661",
"100594890366136568132274633650905676454",
"293072881507757080613530575730021766738",
"292250961461361605217413280980481397551"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-09db9ffb",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/IpFieldMapper.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "134396424628097769735244509765610427325",
"length": 495
},
"id": "CVE-2026-72678-10563ebd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/RoutingFieldMapper.java",
"function": "fuzzyQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "272954859314647263123909975443144777653",
"length": 241
},
"id": "CVE-2026-72678-1272aa88",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/lucene/queries/SortedNumericDocValuesRangeQuery.java",
"function": "newRangeQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "22848489962912717395125876906025266524",
"length": 1193
},
"id": "CVE-2026-72678-151b04b5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/test/java/org/elasticsearch/index/mapper/TextFieldTypeTests.java",
"function": "testPrefixQueryDocValuesOnly"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"283190670438501987514727838726815920477",
"139872482520600089094968553951135983484",
"244928736363048457427079246025589015191"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-15fc2a3d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94",
"target": {
"file": "server/src/test/java/org/elasticsearch/search/fetch/subphase/highlight/PlainHighlighterTests.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "257272680372827337911810308734804520590",
"length": 679
},
"id": "CVE-2026-72678-168e3468",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/test/java/org/elasticsearch/index/mapper/RoutingFieldTypeTests.java",
"function": "testFuzzyQueryDocValues"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"253214962327687458697293851744228962674",
"22023628707689431355101791818041007524",
"103414799870051875915477190718512843255",
"285655303386366806467722352533439983781",
"281317724399236279359610982736862100391",
"72765239727678662142591661805975028123",
"321961970241445156437220288130172815256",
"256570673388934670349670142206998655092",
"50143909241429619877377736126357645543",
"257672686499160816798413107549965643487",
"78784688770878958693649214948236137942",
"66277723380230967401855313766502187710",
"23116884085994545212953255560043990958",
"268734295862612408806991514872300964797",
"338386206661611106278220748744954426618",
"276364368722583032338527935409264475231",
"306415572943709537886650059109011274849",
"104868903728940384329883833790325114941",
"87218321176994229858787086526465891531",
"269037601145664656759293858408551900801",
"155404033901021192223258963494267881403",
"70443580641142454420341853915231025136",
"145548667386584198794410340487029487426",
"16632652845925791443414183954272482765",
"164212823380778918794441751415668463777"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-16c45f44",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/lucene/queries/SortedNumericDocValuesRangeQuery.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"274992522183023089218438232542968799396",
"173940322934652454134273154560064437339",
"8325208987467100328325686091060413882",
"214241318122311603964757613342466207407",
"69839042837717635513155240933728727573",
"2512226894821918829727924849463652483",
"9805650345859792425627637847171710478",
"191335708322584984445492351229876384736",
"245003049968537080247767953908754356796",
"275080994985585732646642964549618530827",
"33967631179385688579877725247600928755",
"9769819747745501990961937553327230237",
"297303162048253147320488859493072619561",
"159894983643915527827708398705454091568"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-22c3b712",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/test/java/org/elasticsearch/index/mapper/flattened/KeyedFlattenedFieldTypeTests.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "81241544047405606522632003424135112527",
"length": 696
},
"id": "CVE-2026-72678-2532a7f5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "modules/mapper-extras/src/test/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldTypeTests.java",
"function": "testRegexpQueryDocValuesOnly"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "17814591615813564355775428497036990414",
"length": 438
},
"id": "CVE-2026-72678-277d3720",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "modules/mapper-extras/src/test/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldTypeTests.java",
"function": "testRegexpQueryDocValuesOnlyCaseInsensitive"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "22677521168560083410445063530987624293",
"length": 833
},
"id": "CVE-2026-72678-290f753a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "x-pack/plugin/mapper-unsigned-long/src/main/java/org/elasticsearch/xpack/unsignedlong/UnsignedLongFieldMapper.java",
"function": "rangeQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "194919762179290610046683685362069497927",
"length": 841
},
"id": "CVE-2026-72678-2bd338e5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/TextFieldMapper.java",
"function": "wildcardQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "233961644639584846741591562128438196313",
"length": 681
},
"id": "CVE-2026-72678-2d9d1789",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/KeywordFieldMapper.java",
"function": "prefixQuery"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"231262441738846545870675035531340178098",
"27399529362196089291737377336698210738",
"198184034113742596100414311000042275832",
"217001668783895066054904409177940917532",
"94522778889656549922641393574861382865",
"321507534254288945536275445095655200460",
"300921655751101597798721670618284354982",
"155571433615047140908350531201695203697",
"54825427795682146603350391377607376958",
"234000679770396912599137589384415616213",
"190529291644002113512891593134710772370",
"155108210879745388207633484589252048438",
"49600389875303787654084238875891266222",
"249354697765847400376185101600203317289",
"69448476286554083668803952821093153272",
"194959586781376324295467668308655596870",
"250789472420568115942738962292962370464",
"241039098149805697323097252044510645959",
"247727200726109314425285644352142597653",
"158079880273341355959410624973311274496",
"30840037820813559649522620767002266740",
"120656659808709034875873621442904316345",
"79621935499872818513590095040841154488",
"204951165984387538508856597169969605783"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-31eba752",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "modules/mapper-extras/src/test/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldTypeTests.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "117684187083423012108085472617175999469",
"length": 1054
},
"id": "CVE-2026-72678-36a1e26e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/lucene/queries/SortedNumericDocValuesRangeQuery.java",
"function": "scorerSupplier"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "324443554272074113463661193367571699701",
"length": 1199
},
"id": "CVE-2026-72678-3741b9fa",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/test/java/org/elasticsearch/index/mapper/TextFieldTypeTests.java",
"function": "testWildcardQueryDocValuesOnly"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "35973537492193988444530376691395407843",
"length": 2369
},
"id": "CVE-2026-72678-3749bff4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94",
"target": {
"file": "server/src/main/java/org/elasticsearch/search/fetch/subphase/highlight/AbstractHighlighterBuilder.java",
"function": "setupParser"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "120690981007339764569187458309554373085",
"length": 621
},
"id": "CVE-2026-72678-40a6e6f0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/test/java/org/elasticsearch/index/mapper/RoutingFieldTypeTests.java",
"function": "testWildcardQueryDocValues"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "282582380564287413725776763366208666892",
"length": 688
},
"id": "CVE-2026-72678-4af7f0a7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/RoutingFieldMapper.java",
"function": "regexpQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "321311134070149240783824711489285336995",
"length": 826
},
"id": "CVE-2026-72678-4db2c116",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/KeywordFieldMapper.java",
"function": "fuzzyQuery"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"158299155865954798697471123488657809952",
"290438277732749345471434798615555663803",
"65611874746019749218585859063673183557",
"36836748939579765223185228370491162810",
"157503281285541764074250705567810892175",
"324012272081145999964910665562408096526",
"291048643231746917545012768600086883939",
"50177173231707158154295888688781724851",
"310063041459095520606022448796695505518",
"46347876943104746414707568975190743135",
"101830628042537755082635755808772036931",
"180732612847602565686147651548021054305",
"230196827303167968907456411013655669081",
"16440820031643057168808298047206059493",
"28096251493121644722945922633513840969",
"131576468658413583282683684796029728846",
"220879638278342704321163095617857131062",
"120721494403118825456860774670731357748",
"33721305282351764979432246707433383021",
"216186493776396525552167392184644277853"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-4f05bc53",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/test/java/org/elasticsearch/index/mapper/RoutingFieldTypeTests.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "299069382151578024839795989994333078958",
"length": 865
},
"id": "CVE-2026-72678-519d0876",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "modules/mapper-extras/src/main/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldMapper.java",
"function": "regexpQuery"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"114508176030696626539066047296433779214",
"43384607500169746049581282043376952148",
"283563727296098110195444588655154165811",
"277031765205288332698033581440269116720",
"187407052376657667672985622362187421922",
"90126549817761157374395826113896432271",
"62431126033836515299954878706677890458",
"276372619117036678140958072933552714348",
"34204804071724460000309539643270206424",
"178874689487166837173458238589286447776"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-56785d56",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94",
"target": {
"file": "server/src/main/java/org/elasticsearch/search/fetch/subphase/highlight/HighlightBuilder.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "13867023443941602265102682281667894052",
"length": 991
},
"id": "CVE-2026-72678-5c1e80e6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/TextFieldMapper.java",
"function": "prefixQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "299069382151578024839795989994333078958",
"length": 865
},
"id": "CVE-2026-72678-5dc67e7e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/TextFieldMapper.java",
"function": "regexpQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "276877686016664170943547964031779829624",
"length": 268
},
"id": "CVE-2026-72678-6225ace6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "x-pack/plugin/downsample/src/main/java/org/elasticsearch/xpack/downsample/DownsampleShardIndexer.java",
"function": "createQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "28901960886106187974505386211677064580",
"length": 365
},
"id": "CVE-2026-72678-67e6dec8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/TextFieldMapper.java",
"function": "termQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "74600334261879604741521313242640339568",
"length": 4662
},
"id": "CVE-2026-72678-687797ed",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94",
"target": {
"file": "server/src/main/java/org/elasticsearch/search/fetch/subphase/highlight/PlainHighlighter.java",
"function": "highlight"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "249829975215623040026717820971717253665",
"length": 519
},
"id": "CVE-2026-72678-6e06ae91",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/test/java/org/elasticsearch/index/mapper/flattened/KeyedFlattenedFieldTypeTests.java",
"function": "testTermsQueryWithSortedSetDocValuesOnly"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "10160088286724545746756661846724288313",
"length": 176
},
"id": "CVE-2026-72678-6e669937",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94",
"target": {
"file": "server/src/test/java/org/elasticsearch/search/fetch/subphase/highlight/HighlightBuilderTests.java",
"function": "getFieldType"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "209510722116369156248077758238561801457",
"length": 1047
},
"id": "CVE-2026-72678-6e90a2f5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/KeywordFieldMapper.java",
"function": "wildcardQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "175608336659589308220602687675562161499",
"length": 934
},
"id": "CVE-2026-72678-7633cec2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/KeywordFieldMapper.java",
"function": "regexpQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "237774244707984564262143441354961075139",
"length": 255
},
"id": "CVE-2026-72678-7e892fe7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/LegacyTypeFieldMapper.java",
"function": "rangeQuery"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"123981481255407045294348322935594806351",
"44204302243386940170311981959959639864",
"131420106978276354911612316684253233665",
"87658692873721293434045014145731391047",
"89565961111605722967981568192712857692",
"263194038508078032790587513132423641433",
"257929515943553399210416517578729308338",
"121625805403105533110683040990667235121",
"43884329338448479852302278361713519333",
"246201673227164427213009568950679993430",
"4709468299743023588656665672960441088",
"222632194900728927199489619294820731255",
"93468074782110413649383207684748418615",
"66157145909160175252111233287589933529",
"166255367629930891641033955460863451043",
"177811184578442322335368907027836724797",
"141930475752604767902217455204238841821",
"260772735535543718916890480775562065782",
"63093408138007908699464550848733117802",
"340007139969966153776593200509109541360",
"310774263480383056817102997580951176891",
"44430289872686780621890100318505480992",
"249150114831686621331448157157860930295",
"151605791150707541189836551182335007455",
"32457392160477534218776129706241005033",
"92731282093362661148757914604841322423",
"181233624261948057208386922751818839772"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-831dc26d",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "modules/mapper-extras/src/main/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldMapper.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"170904724797256563137962626779816612009",
"280165975533075985479552475709246058636",
"127837524543965964660610569377961201648",
"258594428196649702519404259631378281855",
"196835288977964319153200621397593850645",
"70851472792616671836488488696598868211",
"195245424061901508978577495681900861772",
"136108197221795826649413971642009801732",
"138042963707836004098059840579622935110",
"205710732769761493748097307333896728553",
"213670480756579350315852425204600197771",
"322235901232772409215262239603690118995"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-84264732",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "x-pack/plugin/downsample/src/main/java/org/elasticsearch/xpack/downsample/DownsampleShardIndexer.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "214169512007379416294261385373220952572",
"length": 790
},
"id": "CVE-2026-72678-8a94d346",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "modules/mapper-extras/src/test/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldTypeTests.java",
"function": "testWildcardQueryDocValuesOnly"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "194919762179290610046683685362069497927",
"length": 841
},
"id": "CVE-2026-72678-8d97e4ca",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "modules/mapper-extras/src/main/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldMapper.java",
"function": "wildcardQuery"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"123981481255407045294348322935594806351",
"44204302243386940170311981959959639864",
"131420106978276354911612316684253233665",
"313205144234086949387619874115845745234",
"147247772808727365000835392162881565883",
"49506963071760563708494909117891220512",
"257929515943553399210416517578729308338",
"121625805403105533110683040990667235121",
"43884329338448479852302278361713519333",
"195423170977350645124386507709302851717",
"6594204483920868680222172931454387145",
"59573237293865752792567459657781784598",
"11001044368328988540960275163462814913",
"160004791578906769873715620300583182282",
"187259691234723460728062496940442381107",
"255995195478938222048046645820638534837",
"119614628232425111046575880743386686491",
"27350422529721370696073172804890176956",
"27714745724213017792040830682199970281",
"223818959677235182402223183357554728433",
"40703751645971653828573386837157996108",
"66157145909160175252111233287589933529",
"166255367629930891641033955460863451043",
"177811184578442322335368907027836724797",
"141930475752604767902217455204238841821",
"283076309056458468973229571223380378688",
"43261489784283666375604973324136613284",
"66157145909160175252111233287589933529",
"166255367629930891641033955460863451043",
"177811184578442322335368907027836724797",
"141930475752604767902217455204238841821",
"245600864787210620244623774654315731212",
"243133217007217528025747044037055171564",
"340007139969966153776593200509109541360",
"310774263480383056817102997580951176891",
"44430289872686780621890100318505480992",
"337045705982292508207337481184261738187",
"151605791150707541189836551182335007455",
"32457392160477534218776129706241005033",
"92731282093362661148757914604841322423",
"52610850777785354492649522406690795373"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-8e026942",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/KeywordFieldMapper.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "331027999623847724383311912003031096866",
"length": 586
},
"id": "CVE-2026-72678-8f3e26dd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "modules/mapper-extras/src/main/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldMapper.java",
"function": "prefixQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "154671420770954245140816662867195943375",
"length": 437
},
"id": "CVE-2026-72678-93ead5c0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/IpFieldMapper.java",
"function": "convertToDocValuesQuery"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"133411462927699084585462261659984105017",
"144282983868821857195851086506132526755",
"7714489732271407416039058708000131745",
"322579701948388492751071998550408367914",
"170682764861092642277550262568380267753",
"114852989775677865381263859241103490197",
"21331596509338171835985702646533297062",
"335129060167704794066766886741649947118",
"191358222342633768383728661702196220724",
"21118912815188888846588019812225636612",
"234228620740591874404512777291940817724",
"11001044368328988540960275163462814913"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-9553c100",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/LegacyTypeFieldMapper.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"130192812032915568189929366428112074279",
"338587668112843751875004607897056457244",
"311636223832287298418351940618914661904",
"14559433973571236327103093772803942734",
"81766092491860980139880041074416541030",
"83778004218823664808743686188872036723",
"217672029278899031516016760140755058444"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-9734acfc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94",
"target": {
"file": "server/src/main/java/org/elasticsearch/rest/action/search/SearchCapabilities.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "233491607930649407634984525965378032760",
"length": 367
},
"id": "CVE-2026-72678-a408b480",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/KeywordFieldMapper.java",
"function": "termQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "177153981493023677960767003224584378481",
"length": 739
},
"id": "CVE-2026-72678-aa106806",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "modules/mapper-extras/src/test/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldTypeTests.java",
"function": "testPrefixQueryDocValuesOnly"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"288953345354854077790001801438399492168",
"164455731617607039247608044388178637948",
"231067652914584020538293949485143581915",
"202697150930523272718665946242585243548",
"338565860898664850095001390107933850432",
"111632602778036892811214812286385655501",
"57622998469661813808578668317100624789",
"81073906019052243163910379736658572471",
"240004611505933661359316334084333313845",
"204276024962536650034120696864044039326"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-ad557ddf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/flattened/FlattenedFieldMapper.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"243868588130949656791143692081236563864",
"311505216586199373294314499230294889565",
"23300629379259170631342652985157100415",
"99779525804820300359777388439313924719",
"124392759507223488964887386448798184793",
"57056074566821104672192600168236166604",
"183428232184500482658775793061523078930"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-bd63b83e",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94",
"target": {
"file": "server/src/main/java/org/elasticsearch/search/fetch/subphase/highlight/AbstractHighlighterBuilder.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "268054438902092884610470779239085935873",
"length": 888
},
"id": "CVE-2026-72678-c354a3d8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/test/java/org/elasticsearch/index/mapper/KeywordFieldTypeTests.java",
"function": "testRangeQuery"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"262570396947974807532398923668494971644",
"58389485591587880872375759108381094506",
"304512246337602472263022864599860950444",
"184368045976268345340856868536522530760",
"75487787420854223013415960993162458777",
"330915427690360321322798336727709265916",
"151589742277712624771827960488070133965",
"302551852374250195236161664941671832879",
"206237639466547587142448991307376531594",
"38406818615248637556183406942138956552",
"102097723662782091672328944319414049554",
"150369593505711894281186652804139377873",
"47511948615989919507961726401213967526",
"135702458142223632116841990522498485363",
"226375727676935993795356268134213973329",
"179625523733299288739937340896263074776",
"25250820851756373207480287528407707286",
"333239537134558438085664713861509911193",
"48126198197286454736570800749363694390",
"143269063544844444882941092853866730073"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-c990c435",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/test/java/org/elasticsearch/index/mapper/KeywordFieldTypeTests.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"122639132757664986803138175691671001655",
"335892283999867396276535502941166644649",
"252845685254806679929754126735709659653",
"70459544080609156892578956654685198979",
"288350301639674802567568120843372854348",
"128879439556083118790804565740578695567",
"183568503689704087885138164738553210791",
"315988264130765396628199666193426980549",
"110105306531665817097053229432225710351",
"108886619290626151118397149603734671098",
"68900764452827513161409585113073530589",
"109699481272201296627752008736891181922",
"89552474233322494405147063649180198152",
"243794874480578150177830085733756836217",
"128936352400535787295390066296206280301",
"168193967744077208144892951303807415035",
"32485489507345202777470620624306770167",
"82468793747458534960176489784612968344",
"95431536162858288727547312167888083055",
"79895802567313409968279279144916310561",
"109983373614664327492018760324106301607",
"254164139643632659290414288579740637195",
"218911482828271878345863242741149783938",
"290149128642774742559654272690374710990",
"129649976829885946269329561068451864187",
"271521553609249011929656203339955131993",
"116967678018103273313850160203491775016",
"34507466461561024444180968955125864688",
"149539466270008484339757108260134471872",
"241540141246676079432554907112288153733",
"247281622777097759942516432384261889326",
"8682106367820934505412234917026602498",
"258599880353756871245323998211345504441",
"140682565192181975671989624265695960587",
"100268892565605616091333444189761449681",
"214950598829781998119271592022997186976",
"200550104524719405385075838124186899375",
"313720121068230248463194804287647092807",
"188167255630204728049901172366742944889",
"197051329735330186721065881872811534640",
"246392715163119707808625433035684232434",
"127945619089996738346525337879859203179",
"136702270964155933380398036066653195170"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-ca3692e7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94",
"target": {
"file": "server/src/test/java/org/elasticsearch/search/fetch/subphase/highlight/HighlightBuilderTests.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "90624619653879529393067550177924572338",
"length": 2265
},
"id": "CVE-2026-72678-d7e090a8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/lucene/queries/SortedNumericDocValuesRangeQuery.java",
"function": "createWeight"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"222619651141096478816465300519312054261",
"296182117205335300120275499128574113355",
"238799324243410438130683247710717122677",
"201449822339388892733141941969550197131",
"200960559430588746266726625738369495186",
"134609492323651711647577697817611088216",
"317960371168638866971462807031630211171",
"317443264255626593146889852473241092770",
"20880998077061114936653533804355710463",
"250279444475820896094192118818139636127",
"218638487241652355389519182811952131782",
"316490706737803366158794695719834745703",
"30470268583374464618522706524336046485",
"160004791578906769873715620300583182282",
"187259691234723460728062496940442381107",
"255995195478938222048046645820638534837",
"119614628232425111046575880743386686491",
"168711246212498559946182872274862826053",
"27714745724213017792040830682199970281",
"223818959677235182402223183357554728433",
"40703751645971653828573386837157996108",
"66157145909160175252111233287589933529",
"166255367629930891641033955460863451043",
"177811184578442322335368907027836724797",
"141930475752604767902217455204238841821",
"283076309056458468973229571223380378688",
"43261489784283666375604973324136613284",
"340007139969966153776593200509109541360",
"310774263480383056817102997580951176891",
"44430289872686780621890100318505480992",
"170236523216932468148844818179329159249",
"151605791150707541189836551182335007455",
"32457392160477534218776129706241005033",
"92731282093362661148757914604841322423",
"153963534307217003766364156780935899396"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-dae1a278",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/RoutingFieldMapper.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "186492591955110081095185334864085897708",
"length": 674
},
"id": "CVE-2026-72678-dc0a4f96",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94",
"target": {
"file": "server/src/main/java/org/elasticsearch/search/fetch/subphase/highlight/HighlightBuilder.java",
"function": "build"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "100123407710388145007772192562942474536",
"length": 1001
},
"id": "CVE-2026-72678-dda50a9c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/test/java/org/elasticsearch/index/mapper/TextFieldTypeTests.java",
"function": "testRegexpQueryDocValuesOnly"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "110066380476197981234191692838836179556",
"length": 381
},
"id": "CVE-2026-72678-e4312115",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/test/java/org/elasticsearch/index/mapper/flattened/KeyedFlattenedFieldTypeTests.java",
"function": "testTermQueryWithSortedSetDocValuesOnly"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "50460798663850937323875144151113267593",
"length": 3586
},
"id": "CVE-2026-72678-e5c86fee",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94",
"target": {
"file": "server/src/test/java/org/elasticsearch/search/fetch/subphase/highlight/HighlightBuilderTests.java",
"function": "testBuildSearchContextHighlight"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "305869188867308104033177319593392890753",
"length": 130
},
"id": "CVE-2026-72678-eb2280ed",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/LegacyTypeFieldMapper.java",
"function": "termQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "115742967990331344156763366785857507577",
"length": 386
},
"id": "CVE-2026-72678-eff3bbc1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/RoutingFieldMapper.java",
"function": "rangeQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "6775036207659108583463640655473363445",
"length": 703
},
"id": "CVE-2026-72678-f0c19f16",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/KeywordFieldMapper.java",
"function": "rangeQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "103296355740687260756968839897573540889",
"length": 633
},
"id": "CVE-2026-72678-f32b7780",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/test/java/org/elasticsearch/index/mapper/KeywordFieldTypeTests.java",
"function": "testRegexpQueryDocValuesOnlyCaseInsensitive"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "139422809193726721648672856390622725390",
"length": 464
},
"id": "CVE-2026-72678-f45060d1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/test/java/org/elasticsearch/index/mapper/TextFieldTypeTests.java",
"function": "testRegexpQueryDocValuesOnlyCaseInsensitive"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"165280306443633048203347587503547778400",
"321507534254288945536275445095655200460",
"300921655751101597798721670618284354982",
"155571433615047140908350531201695203697",
"181185420139498530760645911740791471016",
"291933034616665983145509819624651375727",
"103648551761629172249178805342556366436",
"212289285374773232109826813432332934643",
"174122518808758360809701298455673638129",
"231925375722152521712669883444083454276",
"59608858761966757754123861669802975764",
"31299853657681819389012091619069310858",
"208638741119865337845046732038648000108",
"233827295439142928885418317596515715521",
"231304210162663406191492666298087060636",
"35355056532148979594233188880812492291",
"300317874516414122381985658933917713929",
"113169603910002188175335785810814481154",
"99639714575822838293690238841039221538",
"109205136646485806255675095577276894279"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-f69dc4df",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/test/java/org/elasticsearch/index/mapper/TextFieldTypeTests.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"250502453778712768962053518703255093608",
"293745187741608286289486472330502044902",
"92285933861987769382932879499624280339",
"48848052402887098574079705828368727963",
"180954780310110417851376237840132855867",
"265701660666103015958674140349152633739",
"219483656979539974598819100907886798376"
],
"threshold": 0.9
},
"id": "CVE-2026-72678-f6f0ec86",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/adc1f04ffdd393d1977990338d5512c5eaf1ce94",
"target": {
"file": "server/src/main/java/org/elasticsearch/search/fetch/subphase/highlight/PlainHighlighter.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "229509955456560670147334768291738740827",
"length": 382
},
"id": "CVE-2026-72678-fcad9667",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "modules/mapper-extras/src/main/java/org/elasticsearch/index/mapper/extras/MatchOnlyTextFieldMapper.java",
"function": "termQuery"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "112299228529160377132220233230014009356",
"length": 912
},
"id": "CVE-2026-72678-fd811cae",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/elastic/elasticsearch/commit/0e1cdd500cb446f51b847d131747da3cc500eee1",
"target": {
"file": "server/src/main/java/org/elasticsearch/index/mapper/KeywordFieldMapper.java",
"function": "normalizedWildcardQuery"
}
}
]
vanir_signatures_modified
"2026-09-03T08:05:32Z"