OpenSearch is vulnerable to DoS via complex query_string inputs

A vulnerability in OpenSearch allows attackers to cause Denial of Service DoS by submitting complex querystring inputs. This issue affects all OpenSearch versions below 2.19.4 and versions 3.0.0 through 3.2.0...

EUVD-2025-199644

A vulnerability in OpenSearch allows attackers to cause Denial of Service DoS by submitting complex querystring inputs. This issue affects all OpenSearch versions below 3.2.0...

com.digitalpebble.stormcrawler:storm-crawler-opensearch (>=2.9, <=2.11), com.erudika:para-search-elasticsearch (>=1.41.1, <=1.41.3) +109 more potentially affected by CVE-2025-9624 via org.opensearch:opensearch-common (>=2.6.0, <=2.19.3)

org.opensearch:opensearch-common MAVEN version =2.6.0, =2.9, =1.41.1, =1.0.0-test, =3.0.3, =13.38.0.release, =13.38.0.release, =13.38.0.release, =0.1.3, =0.1.3, =0.1.3, =0.1.2, =0.1.2, =0.1.2, =2.8.0.1, =0.8.0, =0.17.0 and more Source cves: CVE-2025-9624 Source advisory:...

com.digitalpebble.stormcrawler:storm-crawler-opensearch (>=2.7, <=2.11), com.erudika:para-search-elasticsearch (>=1.40.5, <=1.41.3) +97 more potentially affected by CVE-2025-9624 via org.opensearch:opensearch (>=2.0.0-rc1, <=2.19.3)

org.opensearch:opensearch MAVEN version =2.0.0-rc1, =2.7, =1.40.5, =1.0.0-test, =3.0.3, =13.38.0.release, =13.38.0.release, =13.38.0.release, =1.0.0-alpha, =1.0.0-alpha, =0.1.3, =0.1.3, =0.1.3, =0.1.2, =0.1.2, =0.1.2, =0.1.3 and more Source cves: CVE-2025-9624 Source advisory:...

com.erudika:para-search-elasticsearch (1.42.0), org.codelibs.fesen.client:fesen-httpclient (>=3.0.0, <=3.2.0) +26 more potentially affected by CVE-2025-9624 via org.opensearch:opensearch (>=3.0.0-alpha1, <=3.2.0)

org.opensearch:opensearch MAVEN version =3.0.0-alpha1, =3.0.0, =15.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0.0, =3.22.0, =3.0.0-alpha1, =3.0.0-alpha1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.2 and more Source cves: CVE-2025-9624 Source advisory: SNYK:JAVA-ORGOPENSEARCH-14122812...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via the querystring processing. An attacker can exhaust system resources and disrupt service availability by submitting excessively long Boolean or disjunction queries. PoC GET search "query": "querystring":...

CVE-2025-9624

A vulnerability in OpenSearch allows attackers to cause Denial of Service DoS by submitting complex querystring inputs. This issue affects all OpenSearch versions between 3.0.0 and 3.3.0 and OpenSearch 2.19.4...

UBUNTU-CVE-2025-9624

A vulnerability in OpenSearch allows attackers to cause Denial of Service DoS by submitting complex querystring inputs. This issue affects all OpenSearch versions between 3.0.0 and 3.3.0 and OpenSearch 2.19.4...

com.erudika:para-search-elasticsearch (1.42.0), org.codelibs.fesen.client:fesen-httpclient (>=3.0.0, <=3.2.0) +26 more potentially affected by CVE-2025-9624 via org.opensearch:opensearch (>=3.0.0, <=3.2.0)

org.opensearch:opensearch MAVEN version =3.0.0, =3.0.0, =15.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0.0, =3.22.0, =3.0.0, =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.2 and more Source cves: CVE-2025-9624 Source advisory: MEND:CVE-2025-9624...

com.erudika:para-search-elasticsearch (1.42.0), org.codelibs.fesen.client:fesen-httpclient (>=3.0.0, <=3.2.0) +43 more potentially affected by CVE-2025-9624 via org.opensearch:opensearch-common (>=3.0.0, <=3.2.0)

org.opensearch:opensearch-common MAVEN version =3.0.0, =3.0.0, =15.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0.0, =3.22.0, =3.0.0, =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.2 and more Source cves: CVE-2025-9624 Source advisory: MEND:CVE-2025-9624...

CVE-2025-9624

A vulnerability in OpenSearch allows attackers to cause Denial of Service DoS by submitting complex querystring inputs. This issue affects all OpenSearch versions between 3.0.0 and 3.3.0 and OpenSearch 2.19.4...

CVE-2025-9624

A vulnerability in OpenSearch allows attackers to cause Denial of Service DoS by submitting complex querystring inputs. This issue affects all OpenSearch versions between 3.0.0 and 3.3.0 and OpenSearch 2.19.4...

CVE-2025-9624

OpenSearch CVE-2025-9624: A DoS vulnerability via complex query_string inputs affects OpenSearch 3.0.0–3.2.x and OpenSearch

CVE-2025-9624 OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS

A vulnerability in OpenSearch allows attackers to cause Denial of Service DoS by submitting complex querystring inputs. This issue affects all OpenSearch versions between 3.0.0 and 3.3.0 and OpenSearch 2.19.4...

CVE-2025-9624 OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS

A vulnerability in OpenSearch allows attackers to cause Denial of Service DoS by submitting complex querystring inputs. This issue affects all OpenSearch versions between 3.0.0 and 3.3.0 and OpenSearch 2.19.4...

CVE-2025-9624 OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS

A vulnerability in OpenSearch allows attackers to cause Denial of Service DoS by submitting complex querystring inputs. This issue affects all OpenSearch versions between 3.0.0 and 3.3.0 and OpenSearch 2.19.4...

OpenSearch security vulnerabilities

OpenSearch is a distributed search and analysis software from OpenSearch open source. A security vulnerability exists in OpenSearch versions prior to 3.2.0 that stems from improper handling of complex querystring inputs, which could lead to a denial of service attack...

PT-2025-48080

Name of the Vulnerable Software and Affected Versions OpenSearch versions prior to 3.2.0 Description A flaw exists in OpenSearch that enables attackers to trigger a Denial of Service DoS condition. This is achieved by providing complex query string inputs. Recommendations Update to version 3.2.0 ...

CVE-2025-9624: Uncontrolled Recursion

A vulnerability in OpenSearch allows attackers to cause Denial of Service DoS by submitting complex querystring inputs. This issue affects all OpenSearch versions between 3.0.0 and 3.3.0 and OpenSearch 2.19.4...

PT-2025-55026

Уязвимость программного пакета OpenSearch связана с неконтролируемой рекурсией. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...