TI-2025-08817 Aliases CVE-2025-9624 GHSA-mw3v-mmfw-3x2g

OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS

HIGH 69CWE-674Published 2025-11-25 · Updated 2025-12-15

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-674.

Summary

A vulnerability in OpenSearch allows attackers to cause Denial of Service (DoS) by submitting complex query_string inputs. This issue affects all OpenSearch versions between 3.0.0 and < 3.3.0 and OpenSearch < 2.19.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00727 54th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed OpenSearch (OpenSearch): 3.3.0, 2.19.4org.opensearch:opensearch-common (Maven): 3.3.0, 2.19.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
OpenSearch	OpenSearch	3.0.0 to before 3.3.0; 1.0.0 to before 2.19.4	3.3.0, 2.19.4	Patch available	CNA
—	org.opensearch:opensearch-common (Maven)	3.0.0 to before 3.3.0	3.3.0	Patch available	GHSA-mw3v-mmfw-3x2g
—	org.opensearch:opensearch-common (Maven)	before 2.19.4	2.19.4	Patch available	GHSA-mw3v-mmfw-3x2g

OpenSearch VendorOpenSearch Affected 3.0.0 to before 3.3.0; 1.0.0 to before 2.19.4 Fixed in 3.3.0, 2.19.4 Patch available CNA
org.opensearch:opensearch-common (Maven) Vendor— Affected 3.0.0 to before 3.3.0 Fixed in 3.3.0 Patch available GHSA-mw3v-mmfw-3x2g
org.opensearch:opensearch-common (Maven) Vendor— Affected before 2.19.4 Fixed in 2.19.4 Patch available GHSA-mw3v-mmfw-3x2g

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:amazon:opensearch::::::::	before 3.3.0	Vulnerable	AWS

cpe:2.3:a:amazon:opensearch:*:*:*:*:*:*:*:* Versions before 3.3.0 Vulnerable ·AWS

Remediation

Fix · CNA OpenSearch (OpenSearch) Fixed in 3.3.0, 2.19.4
Fix · GHSA-mw3v-mmfw-3x2g org.opensearch:opensearch-common (Maven) Fixed in 3.3.0 Advisory →
Fix · GHSA-mw3v-mmfw-3x2g org.opensearch:opensearch-common (Maven) Fixed in 2.19.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-9624
2026-10-03 Alias added: GHSA-mw3v-mmfw-3x2g
2026-10-13 EPSS moved to the 50th–90th percentile

References

Exploit 1

https://fluidattacks.com/advisories/chick

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-9624

Other 4

TI-2026-53130 Uncontrolled Resource Consumption in Capabilities Route in OpenSearch Dashboards CVSS 4.0HIGH 8.7
TI-2026-57668 Unrestricted Java Deserialization in OpenSearch SQL Plugin Cursor Pagination CVSS 4.0HIGH 8.7
TI-2026-15136 RCE via Prototype Pollution in OpenSearch Dashboards CVSS 4.0HIGH 8.7
TI-2026-58381 Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards CVSS 4.0MEDIUM 6.3
TI-2026-54191 Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards CVSS 4.0MEDIUM 6.2
TI-2024-26795 OpenSearch Observability does not properly restrict access to private tenant resources CVSS 3.1MEDIUM 5.4

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences