Read the docs
TI-2023-30828 Aliases GHSA-8wx3-324g-w4qq

OpenSearch uncontrolled resource consumption

Priority LOW 38CWE-400Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Denial of service
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-400.

Summary

### Impact An issue has been identified with how OpenSearch handled incoming requests on the HTTP layer. An unauthenticated user could force an OpenSearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering and corresponds to security advisory [ESA-2023-13](https://discuss.elastic.co/t/elasticsearch-8-9-0-7-17-13-security-update/343616) (CVE-2023-31418). ### Mitigation Versions 1.3.14 and 2.11.0 contain a fix for this issue. ### For more information If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to [[email protected]](mailto:[email protected]). Please do not create a public GitHub issue.

Why it matters now

Fix Fixed org.opensearch.plugin:opensearch-security (Maven): 1.3.14.0, 2.11.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—org.opensearch.plugin:opensearch-security (Maven)before 1.3.14.01.3.14.0Patch availableGHSA-8wx3-324g-w4qq
—org.opensearch.plugin:opensearch-security (Maven)2.0.0.0 to before 2.11.0.02.11.0.0Patch availableGHSA-8wx3-324g-w4qq
  • org.opensearch.plugin:opensearch-security (Maven) Vendor— Affected before 1.3.14.0 Fixed in 1.3.14.0 Patch available GHSA-8wx3-324g-w4qq
  • org.opensearch.plugin:opensearch-security (Maven) Vendor— Affected 2.0.0.0 to before 2.11.0.0 Fixed in 2.11.0.0 Patch available GHSA-8wx3-324g-w4qq

Remediation

  • Fix · GHSA-8wx3-324g-w4qq org.opensearch.plugin:opensearch-security (Maven) Fixed in 1.3.14.0 Advisory →
  • Fix · GHSA-8wx3-324g-w4qq org.opensearch.plugin:opensearch-security (Maven) Fixed in 2.11.0.0 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-8wx3-324g-w4qq

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences