Skip to content
OpenAdvisories

Package · Maven

org.elasticsearch.plugin:x-pack-security

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-68384

    Elasticsearch Allocation of Resources Without Limits or Throttling

    Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user setting…

    Elastic Elasticsearch sonarqube elasticsearch Ubuntu Wolfi Maven
  • Medium 6.8
    CVE-2025-37731

    Elasticsearch Improper Authentication

    Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.

    Elastic Elasticsearch sonarqube elasticsearch Ubuntu Wolfi Maven