Skip to content
OpenAdvisories
Medium WID-SEC-2025-2896 2 CVEs

Elasticsearch: Mehrere Schwachstellen ermöglichen Denial of Service

Published Dec 18, 2025 · Updated Dec 18, 2025 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Elasticsearch ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Elasticsearch ist eine Open Source, verteilte Echtzeit-Suche und Analyse-Engine.

Vulnerabilities 2

  • Medium 6.5
    CVE-2025-68384

    Elasticsearch Allocation of Resources Without Limits or Throttling

    Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user setting…

    Elastic Elasticsearch sonarqube elasticsearch Ubuntu Wolfi Maven
  • Medium 4.9
    CVE-2025-68390

    Elasticsearch Allocation of Resources Without Limits or Throttling

    Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory and a denial of service (DoS) via crafted HTTP request.

    Elastic Elasticsearch sonarqube elasticsearch Ubuntu Wolfi Maven

Revision history

  1. #1

    Initiale Fassung

References