CVE-2025-68390
Fixed in a distro release EPSS <1%CVSS 4.9
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory and a denial of service (DoS) via crafted HTTP request.
Products: Elasticsearch
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.elasticsearch.plugin:x-pack-core | 8.19.8 |
| Maven | org.elasticsearch.plugin:x-pack-core | 9.1.8 |
| Maven | org.elasticsearch.plugin:x-pack-core | 9.2.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | commercial-elasticsearch-8.17 | no fix |
| Chainguard | commercial-elasticsearch-8.18 | no fix |
| Chainguard | commercial-elasticsearch-9.0 | no fix |
| Chainguard | elasticsearch-7 | no fix |
| Chainguard | elasticsearch-7-iamguarded | no fix |
| Chainguard | elasticsearch-8.17 | no fix |
| Chainguard | elasticsearch-8.18 | no fix |
| Chainguard | elasticsearch-8.18-iamguarded | no fix |
| Chainguard | elasticsearch-9.0 | no fix |
| Chainguard | elasticsearch-9.0-iamguarded | no fix |
| Chainguard | elasticsearch-fips-8.17 | 8.17.10-r14 |
| Chainguard | elasticsearch-fips-8.17 | 8.17.10-r3 |
| Chainguard | elasticsearch-fips-8.17-bitnami | 8.17.10-r7 |
| Chainguard | elasticsearch-fips-8.17-bitnami | 8.17.10-r14 |
| Chainguard | elasticsearch-fips-8.18 | 8.18.8-r3 |
| Chainguard | elasticsearch-fips-8.18 | 8.18.8-r7 |
| Chainguard | elasticsearch-fips-8.18-bitnami | 8.18.8-r5 |
| Chainguard | elasticsearch-fips-8.18-bitnami | 8.18.8-r7 |
| Chainguard | elasticsearch-fips-9.0 | 9.0.8-r2 |
| Chainguard | elasticsearch-fips-9.0 | 9.0.8-r15 |
| Chainguard | elasticsearch-fips-9.0-bitnami | 9.0.8-r15 |
| Chainguard | ruby3.2-elasticsearch | 0 |
| Chainguard | ruby3.3-elasticsearch | 0 |
| Chainguard | ruby3.4-elasticsearch | 0 |
| Chainguard | ruby4.0-elasticsearch | 9.3.0-r0 |
| Chainguard | sonarqube | 25.12.0.117093-r0 |
| Chainguard | sonarqube-docker-compat | 25.12.0.117093-r0 |
| Chainguard | sonarqube-scripts | 25.12.0.117093-r0 |
| Ubuntu 16.04 LTS | elasticsearch | no fix |
| Wolfi | ruby3.2-elasticsearch | 0 |
| Wolfi | ruby3.3-elasticsearch | 0 |
| Wolfi | ruby3.4-elasticsearch | 0 |
| Wolfi | ruby4.0-elasticsearch | 9.3.0-r0 |
| Wolfi | sonarqube | 25.12.0.117093-r0 |
| Wolfi | sonarqube-docker-compat | 25.12.0.117093-r0 |
| Wolfi | sonarqube-scripts | 25.12.0.117093-r0 |