CVE-2025-68384
Fixed in a distro release EPSS <1%CVSS 6.5
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.
Products: Elasticsearch
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.elasticsearch.plugin:x-pack-security | 8.19.9 |
| Maven | org.elasticsearch.plugin:x-pack-security | 9.1.9 |
| Maven | org.elasticsearch.plugin:x-pack-security | 9.2.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | commercial-elasticsearch-8.17 | no fix |
| Chainguard | commercial-elasticsearch-8.18 | no fix |
| Chainguard | commercial-elasticsearch-9.0 | no fix |
| Chainguard | elasticsearch-7 | no fix |
| Chainguard | elasticsearch-7-iamguarded | no fix |
| Chainguard | elasticsearch-8.17 | no fix |
| Chainguard | elasticsearch-8.18 | no fix |
| Chainguard | elasticsearch-8.18-iamguarded | no fix |
| Chainguard | elasticsearch-9.0 | no fix |
| Chainguard | elasticsearch-9.0-iamguarded | no fix |
| Chainguard | elasticsearch-fips-8.17 | 8.17.10-r14 |
| Chainguard | elasticsearch-fips-8.17-bitnami | 8.17.10-r14 |
| Chainguard | elasticsearch-fips-8.17-bitnami | 8.17.10-r7 |
| Chainguard | elasticsearch-fips-8.18 | 8.18.8-r7 |
| Chainguard | elasticsearch-fips-8.18-bitnami | 8.18.8-r5 |
| Chainguard | elasticsearch-fips-8.18-bitnami | 8.18.8-r7 |
| Chainguard | elasticsearch-fips-9.0 | no fix |
| Chainguard | elasticsearch-fips-9.0-bitnami | no fix |
| Chainguard | ruby3.2-elasticsearch | 0 |
| Chainguard | ruby3.3-elasticsearch | 0 |
| Chainguard | ruby3.4-elasticsearch | 0 |
| Chainguard | ruby4.0-elasticsearch | 9.3.0-r0 |
| Chainguard | sonarqube | 25.12.0.117093-r2 |
| Ubuntu 16.04 LTS | elasticsearch | no fix |
| Wolfi | ruby3.2-elasticsearch | 0 |
| Wolfi | ruby3.3-elasticsearch | 0 |
| Wolfi | ruby3.4-elasticsearch | 0 |
| Wolfi | ruby4.0-elasticsearch | 9.3.0-r0 |
| Wolfi | sonarqube | 25.12.0.117093-r2 |