CVE-2025-68384 Elasticsearch Allocation of Resources Without Limits or Throttling

Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation CAPEC-130 causing a persistent denial of service OOM crash via submission of oversized user settings data...

Elasticsearch 8.19.8, 9.1.8, and 9.2.2 Security Update (ESA-2025-37)

Elasticsearch Allocation of Resources Without Limits or Throttling ESA-2025-37 Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation CAPEC-130 of memory and a denial of service D...

Elasticsearch 8.19.9, 9.1.9, and 9.2.3 Security Update (ESA-2025-33)

Elasticsearch Allocation of Resources Without Limits or Throttling ESA-2025-33 Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation CAPEC-130 causing a persistent denial of service OOM crash via...

BIT-ELASTICSEARCH-2025-37731 Elasticsearch Improper Authentication

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority...

PT-2025-52366

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description A flaw exists in Elasticsearch where a low-privileged authenticated user can trigger excessive resource allocation, leading to a persistent denial of service and potentially causing an...

PT-2025-52370

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An issue exists in Elasticsearch where an authenticated user with snapshot restore privileges can cause excessive memory allocation, leading to a denial of service. This occurs through...

Elasticsearch 安全漏洞

Elasticsearch is a search and analytics engine from Dutch company Elastic. A security vulnerability exists in Elasticsearch that stems from an unrestricted resource allocation that could lead to a denial of service...

CVE-2025-37731

A flaw was found in Elasticsearch. This vulnerability allows user impersonation via specially crafted client certificates signed by a legitimate, trusted Certificate Authority CA. Mitigation To reduce the risk of exploitation, ensure that the Certificate Authority CA used for the Elasticsearch PK...

Linux Distros Unpatched Vulnerability : CVE-2025-37731

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to hav...

net.sc8s:elastic-testkit_2.13 (>=0.102.0 <=0.110.0), org.elasticsearch.test:framework (>=9.0.0 <=9.1.10) +3 more potentially affected by CVE-2025-37731 via org.elasticsearch:elasticsearch (>=9.0.0-beta1 <=9.1.7)

org.elasticsearch:elasticsearch MAVEN version =9.0.0-beta1, =0.102.0, =9.0.0, =9.0.0, =1.7.es904.0, =9.0.0, =9.1.5 Source cves: CVE-2025-37731 Source advisory: OSV:GHSA-M9GH-789G-Q5PV...

org.elasticsearch.test:framework (>=9.2.0 <=9.2.1), org.elasticsearch.test:yaml-rest-runner (>=9.2.0 <=9.2.1) +1 more potentially affected by CVE-2025-37731 via org.elasticsearch:elasticsearch (>=9.2.0 <=9.2.1)

org.elasticsearch:elasticsearch MAVEN version =9.2.0, =9.2.0, =9.2.0, =9.2.1 - pl.allegro.tech.elasticsearch.plugin:elasticsearch-analysis-morfologik =9.2.1 Source cves: CVE-2025-37731 Source advisory: OSV:GHSA-M9GH-789G-Q5PV...

ai.ylyue:yue-library-data-es (>=j8.2.2.0 <=j11.2.6.2), br.com.simpli:simpli-ws (>=1.2.1 <=2.2.0) +1034 more potentially affected by CVE-2025-37731 via org.elasticsearch:elasticsearch (>=7.0.0-alpha1 <=8.19.7)

org.elasticsearch:elasticsearch MAVEN version =7.0.0-alpha1, =j8.2.2.0, =1.2.1, =0.0.1-alpha, =5.3.0, =5.6.5, =5.3.0, =5.3.0, =5.3.0, =5.3.0, =6.2.0, =6.8.0, =6.4.0, =5.3.0, =5.3.0, =5.3.0, =5.4.0 and more Source cves: CVE-2025-37731 Source advisory: OSV:GHSA-M9GH-789G-Q5PV...

Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority...

GHSA-M9GH-789G-Q5PV Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates

Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority...

org.elasticsearch.plugin:transport-netty4 (>=9.2.0 <=9.2.1), org.elasticsearch.plugin:x-pack-core (>=9.2.0 <=9.2.1) +3 more potentially affected by CVE-2025-37731 via org.elasticsearch:elasticsearch-ssl-config (>=9.2.0 <=9.2.1)

org.elasticsearch:elasticsearch-ssl-config MAVEN version =9.2.0, =9.2.0, =9.2.0, =9.2.0, =9.2.0, =9.2.0, =9.2.1 Source cves: CVE-2025-37731 Source advisory: SNYK:JAVA-ORGELASTICSEARCH-14417579...

net.sc8s:elastic-testkit_2.13 (>=0.102.0 <=0.110.0), org.elasticsearch.plugin:transport-netty4 (>=9.0.0 <=9.1.10) +4 more potentially affected by CVE-2025-37731 via org.elasticsearch:elasticsearch-ssl-config (>=9.0.0-beta1 <=9.1.7)

org.elasticsearch:elasticsearch-ssl-config MAVEN version =9.0.0-beta1, =0.102.0, =9.0.0, =9.0.0, =9.1.4, =9.0.0, =9.0.0, =9.1.10 Source cves: CVE-2025-37731 Source advisory: SNYK:JAVA-ORGELASTICSEARCH-14417579...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via the PKI realm. An attacker can impersonate other users by presenting specially crafted client certificates signed by a trusted Certificate Authority. Note: This is only exploitable if the attacker...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation via the PKI realm. An attacker can impersonate other users by presenting specially crafted client certificates signed by a trusted Certificate Authority. Note: This is only exploitable if the attacker...

com.aconex.scrutineer:scrutineer (=7.9.3), org.elasticsearch.client:x-pack-transport (>=7.8.1 <=7.9.3) potentially affected by CVE-2025-37731 via org.elasticsearch.plugin:x-pack-core (>=7.8.1 <=7.9.3)

org.elasticsearch.plugin:x-pack-core MAVEN version =7.8.1, =7.8.1, =7.9.3 Source cves: CVE-2025-37731 Source advisory: SNYK:JAVA-ORGELASTICSEARCHPLUGIN-14417581...

com.aconex.scrutineer:scrutineer (=7.9.3), com.playtika.testcontainers:embedded-elasticsearch (>=2.0.0 <=2.0.11) +15 more potentially affected by CVE-2025-37731 via org.elasticsearch:elasticsearch-ssl-config (>=7.8.1 <=8.19.7)

org.elasticsearch:elasticsearch-ssl-config MAVEN version =7.8.1, =2.0.0, =0.2.7.1, =0.83.0, =7.9.01, =7.8.1, =1.5.0, =7.8.1, =7.8.1, =7.8.1, =8.10.0, =7.8.1, =8.10.0, =8.0.0, =8.19.16 and more Source cves: CVE-2025-37731 Source advisory: SNYK:JAVA-ORGELASTICSEARCH-14417579...