Read the docs
TI-2023-30855 Aliases GHSA-6g3j-p5g6-992f

OpenSearch StackOverflow vulnerability

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

### Impact A flaw was discovered in OpenSearch, affecting the `_search` API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service. The issue was identified by Elastic Engineering and corresponds to security advisory [ESA-2023-14](https://discuss.elastic.co/t/elasticsearch-8-9-1-7-17-13-security-update/343297) (CVE-2023-31419). ### Mitigation Versions 1.3.14 and 2.11.1 contain a fix for this issue. ### For more information If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to [[email protected]](mailto:[email protected]). Please do not create a public GitHub issue.

Why it matters now

Fix Fixed org.opensearch:opensearch (Maven): 1.3.14, 2.11.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—org.opensearch:opensearch (Maven)before 1.3.141.3.14Patch availableGHSA-6g3j-p5g6-992f
—org.opensearch:opensearch (Maven)2.0.0 to before 2.11.12.11.1Patch availableGHSA-6g3j-p5g6-992f
  • org.opensearch:opensearch (Maven) Vendor— Affected before 1.3.14 Fixed in 1.3.14 Patch available GHSA-6g3j-p5g6-992f
  • org.opensearch:opensearch (Maven) Vendor— Affected 2.0.0 to before 2.11.1 Fixed in 2.11.1 Patch available GHSA-6g3j-p5g6-992f

Remediation

  • Fix · GHSA-6g3j-p5g6-992f org.opensearch:opensearch (Maven) Fixed in 1.3.14 Advisory →
  • Fix · GHSA-6g3j-p5g6-992f org.opensearch:opensearch (Maven) Fixed in 2.11.1 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-6g3j-p5g6-992f

References

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences