Description
A vulnerability in OpenSearch allows attackers to cause Denial of Service (DoS) by submitting complex query_string inputs.
This issue affects all OpenSearch versions between 3.0.0 and < 3.3.0 and OpenSearch < 2.19.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenSearch | OpenSearch | 3.0.0 – < 3.3.0, 1.0.0 – < 2.19.4 | 3.3.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | opensearch | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | opensearch-2 | 2.19.4-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.opensearch:opensearch-common | >= 3.0.0, < 3.3.0 | 3.3.0 | GHSA-mw3v-mmfw-3x2g |
| Maven | org.opensearch:opensearch-common | < 2.19.4 | 2.19.4 | GHSA-mw3v-mmfw-3x2g |
Advisories 2
- WID-SEC-2026-2451 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 2, 2026
- WID-SEC-2025-2680 OpenSearch: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 25, 2025
References
- https://fluidattacks.com/advisories/chick third-party-advisory
- https://github.com/opensearch-project/OpenSearch/releases/tag/3.3.0 patch release-notes
- https://github.com/opensearch-project/OpenSearch/releases/tag/2.19.4 patch release-notes