GHSA-2CQF-6XV9-F22W Elasticsearch vulnerable to Uncontrolled Resource Consumption

🗓️ 26 Oct 2023 18:30:23Reported by GoogleType

osv

osv🔗 osv.dev👁 2 Views

Elasticsearch HTTP layer may crash with Out of Memory error from unauthenticated malformed requests.

Reporter	Title	Published	Views	Family All 31
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Elasticsearch affect watsonx.data	3 Sep 202421:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson CP4D Data Stores is vulnerable to Elastic Elasticsearch denial of service vulnerabilitiy.(CVE-2023-31418)	21 Jun 202415:01	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Elasticsearch affect watsonx.data	16 Sep 202417:08	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insights 1.6.13 addresses multiple security vulnerabilities.	31 Jul 202411:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Elasticsearch denial of service vulnerabilities.	5 Feb 202420:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in elasticsearch-7.10.2.jar	5 Sep 202421:54	–	ibm
BDU FSTEC	The vulnerability of the Elasticsearch search engine, related to uncontrolled resource consumption, allows a hacker to cause a service failure.	16 Nov 202300:00	–	bdu_fstec
Circl	CVE-2023-31418	26 Oct 202322:16	–	circl
CNNVD	Elasticsearch Resource Management Error Vulnerability	26 Oct 202300:00	–	cnnvd
CVE	CVE-2023-31418	26 Oct 202317:36	–	cve

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-31418
discuss	www.discuss.elastic.co/t/elasticsearch-8-9-0-7-17-13-security-update/343616
security	www.security.netapp.com/advisory/ntap-20231130-0005
elastic	www.elastic.co/community/security

04 Feb 2026 02:14Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.01232

Elasticsearch Unauthenticated user Out of memory Malformed requests Web layer Resource exhaustion