Vulnerability · Published Oct 26, 2023 · Assigned by elastic
CVE-2023-31418Elasticsearch uncontrolled resource consumption
High 7.5
In plain English
A high-severity uncontrolled resource consumption in Elasticsearch from Elastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering and we have no indication that the issue is known or that it is being exploited in the wild.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.elasticsearch:elasticsearch | 7.17.13 | GHSA-2cqf-6xv9-f22w |
| Maven | org.elasticsearch:elasticsearch | 8.9.0 | GHSA-2cqf-6xv9-f22w |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Elasticsearch | 7.17.128.0.0 – before 8.8.22.13.3 – before 3.6.0 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H