CVE-2025-35434 CISA Thorium does not validate TLS connections to Elasticsearch

CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. An unauthenticated attacker with access to a Thorium cluster could impersonate the Elasticsearch service. Fixed in 1.1.2...

PT-2025-38233

Name of the Vulnerable Software and Affected Versions: CISA Thorium versions prior to 1.1.2 Description: CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. This allows an unauthenticated attacker with access to a Thorium cluster to impersonate the Elasticsearch...

CISA Thorium 安全漏洞

CISA Thorium is a highly scalable distributed malware analysis and data generation framework from the U.S. Cybersecurity and Infrastructure Security Administration CISA government division. A security vulnerability exists in CISA Thorium versions prior to 1.1.2 that stems from unvalidated TLS...

When AI chatbots leak and how it happens

In a recent article on Cybernews there were two clear signs of how fast the world of AI chatbots is growing. A company I had never even heard of had over 150 million app downloads across its portfolio, and it also had an exposed unprotected Elasticsearch instance. This needs a bit of an...

Linux Distros Unpatched Vulnerability : CVE-2024-12539

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered where improper authorization controls affected certain queries that could allow a malicious actor to circumvent Document Level Security ...

Linux Distros Unpatched Vulnerability : CVE-2024-23791

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insertion of debug information into log file during building the elastic search index allows reading of sensitive information from articles.This issue affects...

Linux Distros Unpatched Vulnerability : CVE-2024-52980

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the...

Linux Distros Unpatched Vulnerability : CVE-2024-52981

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a...

Linux Distros Unpatched Vulnerability : CVE-2024-23444

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is used with the csr option in order to create a new Certificate Signing...

CVE-2025-8885 vulnerabilities

Vulnerabilities for packages: elasticsearch, bouncycastle-fips...

GHSA-67MF-3CR5-8W23 vulnerabilities

Vulnerabilities for packages: elasticsearch, bouncycastle-fips...

Linux Distros Unpatched Vulnerability : CVE-2020-7019

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same...

Elasticsearch Uncontrolled Resource Consumption vulnerability

...

An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.

...

Linux Distros Unpatched Vulnerability : CVE-2023-31417

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied when...

Linux Distros Unpatched Vulnerability : CVE-2021-22147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to...

Linux Distros Unpatched Vulnerability : CVE-2021-22144

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the...

Linux Distros Unpatched Vulnerability : CVE-2020-7020

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly...

Linux Distros Unpatched Vulnerability : CVE-2021-22137

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not...

Linux Distros Unpatched Vulnerability : CVE-2020-7009

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker...