CVE-2025-68390

A flaw was found in Elasticsearch. An authenticated user, with snapshot restore privileges, can cause an excessive memory allocation via a crafted HTTP request, resulting in a denial of service. Mitigation To mitigate this issue, make sure that only necessary and trusted users have authentication...

org.elasticsearch.client:x-pack-transport (7.17.13) potentially affected by CVE-2025-68390 via org.elasticsearch.plugin:x-pack-core (7.17.13)

org.elasticsearch.plugin:x-pack-core MAVEN version 7.17.13 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch.plugin:x-pack-core and may be impacted: - org.elasticsearch.client:x-pack-transport 7.17.13 Source cves: CVE-2025-68390 Source...

org.elasticsearch.client:x-pack-transport (7.17.1) potentially affected by CVE-2025-68390 via org.elasticsearch.plugin:x-pack-core (7.17.1)

org.elasticsearch.plugin:x-pack-core MAVEN version 7.17.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch.plugin:x-pack-core and may be impacted: - org.elasticsearch.client:x-pack-transport 7.17.1 Source cves: CVE-2025-68390 Source...

org.elasticsearch.client:x-pack-transport (7.13.1) potentially affected by CVE-2025-68390 via org.elasticsearch.plugin:x-pack-core (7.13.1)

org.elasticsearch.plugin:x-pack-core MAVEN version 7.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch.plugin:x-pack-core and may be impacted: - org.elasticsearch.client:x-pack-transport 7.13.1 Source cves: CVE-2025-68390 Source...

org.elasticsearch.client:x-pack-transport (7.11.2) potentially affected by CVE-2025-68390 via org.elasticsearch.plugin:x-pack-core (7.11.2)

org.elasticsearch.plugin:x-pack-core MAVEN version 7.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch.plugin:x-pack-core and may be impacted: - org.elasticsearch.client:x-pack-transport 7.11.2 Source cves: CVE-2025-68390 Source...

org.elasticsearch.client:x-pack-transport (7.17.27) potentially affected by CVE-2025-68390 via org.elasticsearch.plugin:x-pack-core (7.17.27)

org.elasticsearch.plugin:x-pack-core MAVEN version 7.17.27 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch.plugin:x-pack-core and may be impacted: - org.elasticsearch.client:x-pack-transport 7.17.27 Source cves: CVE-2025-68390 Source...

org.elasticsearch.client:x-pack-transport (7.16.2) potentially affected by CVE-2025-68390 via org.elasticsearch.plugin:x-pack-core (7.16.2)

org.elasticsearch.plugin:x-pack-core MAVEN version 7.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch.plugin:x-pack-core and may be impacted: - org.elasticsearch.client:x-pack-transport 7.16.2 Source cves: CVE-2025-68390 Source...

org.elasticsearch.client:x-pack-transport (7.17.18) potentially affected by CVE-2025-68390 via org.elasticsearch.plugin:x-pack-core (7.17.18)

org.elasticsearch.plugin:x-pack-core MAVEN version 7.17.18 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch.plugin:x-pack-core and may be impacted: - org.elasticsearch.client:x-pack-transport 7.17.18 Source cves: CVE-2025-68390 Source...

org.elasticsearch.client:x-pack-transport (7.17.10) potentially affected by CVE-2025-68390 via org.elasticsearch.plugin:x-pack-core (7.17.10)

org.elasticsearch.plugin:x-pack-core MAVEN version 7.17.10 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch.plugin:x-pack-core and may be impacted: - org.elasticsearch.client:x-pack-transport 7.17.10 Source cves: CVE-2025-68390 Source...

org.elasticsearch.client:x-pack-transport (6.8.22) potentially affected by CVE-2025-68390 via org.elasticsearch.plugin:x-pack-core (6.8.22)

org.elasticsearch.plugin:x-pack-core MAVEN version 6.8.22 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch.plugin:x-pack-core and may be impacted: - org.elasticsearch.client:x-pack-transport 6.8.22 Source cves: CVE-2025-68390 Source...

org.elasticsearch.client:x-pack-transport (7.14.2) potentially affected by CVE-2025-68390 via org.elasticsearch.plugin:x-pack-core (7.14.2)

org.elasticsearch.plugin:x-pack-core MAVEN version 7.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch.plugin:x-pack-core and may be impacted: - org.elasticsearch.client:x-pack-transport 7.14.2 Source cves: CVE-2025-68390 Source...

org.elasticsearch.client:x-pack-transport (7.17.7) potentially affected by CVE-2025-68390 via org.elasticsearch.plugin:x-pack-core (7.17.7)

org.elasticsearch.plugin:x-pack-core MAVEN version 7.17.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch.plugin:x-pack-core and may be impacted: - org.elasticsearch.client:x-pack-transport 7.17.7 Source cves: CVE-2025-68390 Source...

com.aconex.scrutineer:scrutineer (7.9.3), org.elasticsearch.client:x-pack-transport (7.9.3) potentially affected by CVE-2025-68390 via org.elasticsearch.plugin:x-pack-core (7.9.3)

org.elasticsearch.plugin:x-pack-core MAVEN version 7.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch.plugin:x-pack-core and may be impacted: - com.aconex.scrutineer:scrutineer 7.9.3 - org.elasticsearch.client:x-pack-transport 7.9....

org.elasticsearch.client:x-pack-transport (6.8.11) potentially affected by CVE-2025-68390 via org.elasticsearch.plugin:x-pack-core (6.8.11)

org.elasticsearch.plugin:x-pack-core MAVEN version 6.8.11 is affected by a known vulnerability. The following packages have a transitive dependency on org.elasticsearch.plugin:x-pack-core and may be impacted: - org.elasticsearch.client:x-pack-transport 6.8.11 Source cves: CVE-2025-68390 Source...

Linux Distros Unpatched Vulnerability : CVE-2025-68390

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessiv...

CVE-2025-68390

creationtimestamp| type| source ---|---|--- 2025-12-18 23:58:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3maceylmwic2r...

ai.ylyue:yue-library-data-es (>=j8.2.2.0, <=j11.2.6.2), br.com.simpli:simpli-ws (>=1.2.1, <=2.2.0) +1045 more potentially affected by CVE-2025-68390 via org.elasticsearch:elasticsearch (>=7.0.0-alpha1, <=8.19.7)

org.elasticsearch:elasticsearch MAVEN version =7.0.0-alpha1, =j8.2.2.0, =1.2.1, =0.0.1-alpha, =5.3.0, =5.6.5, =5.3.0, =5.3.0, =5.3.0, =5.3.0, =6.2.0, =6.8.0, =6.4.0, =5.3.0, =5.3.0, =5.3.0, =5.4.0 and more Source cves: CVE-2025-68390 Source advisory: SNYK:JAVA-ORGELASTICSEARCH-14534841...

net.sc8s:elastic-testkit_2.13 (>=0.102.0, <=0.112.0), org.elasticsearch.test:framework (>=9.0.0-beta1, <=9.1.7) +3 more potentially affected by CVE-2025-68390 via org.elasticsearch:elasticsearch (>=9.0.0-beta1, <=9.1.7)

org.elasticsearch:elasticsearch MAVEN version =9.0.0-beta1, =0.102.0, =9.0.0-beta1, =9.0.0-beta1, =1.7.es904.0, =9.0.0, =9.1.5 Source cves: CVE-2025-68390 Source advisory: SNYK:JAVA-ORGELASTICSEARCH-14534841...

com.aconex.scrutineer:scrutineer (>=6.8.13-1, <=7.9.3), com.bbossgroups.plugins:bboss-elasticsearch (>=5.0.3.7.4, <=6.2.0) +21 more potentially affected by CVE-2025-68390 via org.elasticsearch.plugin:x-pack-core (>=6.8.11, <=7.17.29)

org.elasticsearch.plugin:x-pack-core MAVEN version =6.8.11, =6.8.13-1, =5.0.3.7.4, =5.0.3.6, =5.1.1, =5.1.1, =0.3.11, =0.3.11, =2.0.0, =3.3.0, =6.2.2.0, =1.0, =1.2.0, =1.6.1 and more Source cves: CVE-2025-68390 Source advisory: MEND:CVE-2025-68390...

CVE-2025-68390 Elasticsearch Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation CAPEC-130 of memory and a denial of service DoS via crafted HTTP request...