CVE-2025-68390
Elasticsearch Allocation of Resources Without Limits or Throttling
Summary
Elasticsearch Allocation of Resources Without Limits or Throttling
Original description
The description as published by the source.
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory and a denial of service (DoS) via crafted HTTP request.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
elasticsearch
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.19.8"},{"introduced":"9.0.0"},{"fixed":"9.1.8"},{"introduced":"9.2.0"},{"fixed":"9.2.2"}]}]
References
- advisory nvd.nist.gov
- advisory github.com
- web discuss.elastic.co