CVE-2025-68384
Medium · 6.5Elasticsearch has Excessive Allocation of Resources via Submission of Oversized User Settings Data
CVSS
6.5
EPSS
0.3%
Published
Dec 19, 2025
CISA due date
—
The record
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.elasticsearch.plugin:x-pack-security | 0 | 8.19.9 |
| Maven | org.elasticsearch.plugin:x-pack-security | 9.0.0 | 9.1.9 |
| Maven | org.elasticsearch.plugin:x-pack-security | 9.2.0 | 9.2.3 |
| Bitnami | elasticsearch | 0 | 8.19.9 |
| Chainguard | elasticsearch-8.17-config | 0 | 8.17.10-r15 |
| Chainguard | elasticsearch-8.18-config | 0 | 8.18.8-r2 |
| Chainguard | elasticsearch-9.0-config | 0 | 9.0.8-r2 |
| Chainguard | elasticsearch-fips-8.17-config | 0 | 8.17.10-r3 |
| Chainguard | elasticsearch-fips-8.18-config | 0 | 8.18.8-r3 |
| Chainguard | elasticsearch-fips-9.0-config | 0 | 9.0.8-r2 |
| Chainguard | ruby3.2-elasticsearch | 0 | 0 |
| Chainguard | ruby3.3-elasticsearch | 0 | 0 |
| Chainguard | ruby3.4-elasticsearch | 0 | 0 |
| Chainguard | ruby4.0-elasticsearch | 0 | 9.3.0-r0 |
| Chainguard | sonarqube | 0 | 25.12.0.117093-r2 |
| Chainguard | sonarqube-docker-compat | 0 | 25.12.0.117093-r2 |
| Chainguard | sonarqube-scripts | 0 | 25.12.0.117093-r2 |
| Wolfi | ruby3.2-elasticsearch | 0 | 0 |
| Wolfi | ruby3.3-elasticsearch | 0 | 0 |
| Wolfi | ruby3.4-elasticsearch | 0 | 0 |
| Wolfi | ruby4.0-elasticsearch | 0 | 9.3.0-r0 |
| Wolfi | sonarqube | 0 | 25.12.0.117093-r2 |
| Wolfi | sonarqube-docker-compat | 0 | 25.12.0.117093-r2 |
| Wolfi | sonarqube-scripts | 0 | 25.12.0.117093-r2 |
| maven | org.elasticsearch.plugin/x-pack-security | 9.0.0 | 9.1.9 |
| maven | org.elasticsearch.plugin/x-pack-security | 9.2.0 | 9.2.3 |
Related vulnerabilities
- CVE-2025-68390 Elasticsearch privileged authenticated users can cause DoS through Excessive Resource… Also affects elasticsearch
- CVE-2025-37731 Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via… Also affects elasticsearch
- CVE-2024-12539 Elasticsearch Incorrect Authorization vulnerability Also affects elasticsearch
- CVE-2024-23444 It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is… Also affects elasticsearch
- CVE-2023-49921 An issue was discovered by Elastic whereby Watcher search input logged the search query… Also affects elasticsearch
- CVE-2024-37280 A flaw was discovered in Elasticsearch, affecting document ingestion when an index… Also affects elasticsearch
- CVE-2024-23445 It was identified that if a cross-cluster API key… Also affects elasticsearch
- CVE-2024-23449 An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF… Also affects elasticsearch