Skip to content
OpenAdvisories

Package · Maven

org.elasticsearch.plugin:x-pack-core

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Medium 4.9
    CVE-2025-68390

    Elasticsearch Allocation of Resources Without Limits or Throttling

    Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory and a denial of service (DoS) via crafted HTTP request.

    Elastic Elasticsearch sonarqube elasticsearch Ubuntu Wolfi Maven
  • Medium 6.8
    CVE-2025-37731

    Elasticsearch Improper Authentication

    Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.

    Elastic Elasticsearch sonarqube elasticsearch Ubuntu Wolfi Maven