CVE-2025-68390
Medium · 4.9Elasticsearch privileged authenticated users can cause DoS through Excessive Resource Allocation
CVSS
4.9
EPSS
0.4%
Published
Dec 19, 2025
CISA due date
—
The record
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory and a denial of service (DoS) via crafted HTTP request.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.elasticsearch.plugin:x-pack-core | 0 | 8.19.8 |
| Maven | org.elasticsearch.plugin:x-pack-core | 9.0.0 | 9.1.8 |
| Maven | org.elasticsearch.plugin:x-pack-core | 9.2.0 | 9.2.2 |
| Bitnami | elasticsearch | 0 | 8.19.8 |
| Chainguard | elasticsearch-8.17-config | 0 | 8.17.10-r15 |
| Chainguard | elasticsearch-8.18-config | 0 | 8.18.8-r2 |
| Chainguard | elasticsearch-9.0-config | 0 | 9.0.8-r2 |
| Chainguard | elasticsearch-fips-8.17-config | 0 | 8.17.10-r3 |
| Chainguard | elasticsearch-fips-8.18-config | 0 | 8.18.8-r3 |
| Chainguard | elasticsearch-fips-9.0-config | 0 | 9.0.8-r2 |
| Chainguard | ruby3.2-elasticsearch | 0 | 0 |
| Chainguard | ruby3.3-elasticsearch | 0 | 0 |
| Chainguard | ruby3.4-elasticsearch | 0 | 0 |
| Chainguard | ruby4.0-elasticsearch | 0 | 9.3.0-r0 |
| Chainguard | sonarqube | 0 | 25.12.0.117093-r0 |
| Chainguard | sonarqube-docker-compat | 0 | 25.12.0.117093-r0 |
| Chainguard | sonarqube-scripts | 0 | 25.12.0.117093-r0 |
| Wolfi | ruby3.2-elasticsearch | 0 | 0 |
| Wolfi | ruby3.3-elasticsearch | 0 | 0 |
| Wolfi | ruby3.4-elasticsearch | 0 | 0 |
| Wolfi | ruby4.0-elasticsearch | 0 | 9.3.0-r0 |
| Wolfi | sonarqube | 0 | 25.12.0.117093-r0 |
| Wolfi | sonarqube-docker-compat | 0 | 25.12.0.117093-r0 |
| Wolfi | sonarqube-scripts | 0 | 25.12.0.117093-r0 |
| maven | org.elasticsearch.plugin/x-pack-core | 9.0.0 | 9.1.8 |
| maven | org.elasticsearch.plugin/x-pack-core | 9.2.0 | 9.2.2 |
Related vulnerabilities
- CVE-2025-68384 Elasticsearch has Excessive Allocation of Resources via Submission of Oversized User… Also affects elasticsearch
- CVE-2025-37731 Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via… Also affects elasticsearch
- CVE-2024-12539 Elasticsearch Incorrect Authorization vulnerability Also affects elasticsearch
- CVE-2024-23444 It was discovered by Elastic engineering that when elasticsearch-certutil CLI tool is… Also affects elasticsearch
- CVE-2023-49921 An issue was discovered by Elastic whereby Watcher search input logged the search query… Also affects elasticsearch
- CVE-2024-37280 A flaw was discovered in Elasticsearch, affecting document ingestion when an index… Also affects elasticsearch
- CVE-2024-23445 It was identified that if a cross-cluster API key… Also affects elasticsearch
- CVE-2024-23449 An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF… Also affects elasticsearch