Vulnerabilities

TI-2025-08817 CVE-2025-9624 · GHSA-mw3v-mmfw-3x2g

OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS

HIGH 69

A vulnerability in OpenSearch allows attackers to cause Denial of Service (DoS) by submitting complex query_string inputs.

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00727 Published 2025-11-25 Fixed in 3.3.0, 2.19.4 CWE-674

TI-2023-24568 CVE-2023-45807 · GHSA-72q2-gwwf-6hrv

OpenSearch Issue with tenant read-only permissions

LOW 25

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana following the license change in early 2021.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00487 Published 2023-10-16 Fixed in 1.3.14.0, 2.11.0.0 CWE-281

TI-2023-14851 CVE-2023-31141 · GHSA-g8xc-6mf7-h28h

OpenSearch issue with fine-grained access control during extremely rare race conditions

LOW 27

OpenSearch is open-source software suite for search, analytics, and observability applications.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.0046 Published 2023-05-08 Fixed in 1.3.10, 2.7.0 +2 CWE-863

TI-2023-11077 CVE-2023-25806 · GHSA-c6wg-cm5x-rqvj

Time discrepancy in authentication responses in OpenSearch

LOW 30

OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00328 Published 2023-03-02 Fixed in 1.3.9, 2.6.0 CWE-208

TI-2023-09731 CVE-2023-23933

Issue in Anomaly Detection with document and field level rules in numerical feature aggregations

LOW 21

OpenSearch Anomaly Detection identifies atypical data and receives automatic notifications.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00512 Published 2023-02-03 Fixed in 1.3.8, 2.6.0 CWE-125

TI-2023-09441 CVE-2023-23612 · GHSA-864v-6qj7-62qj

Issue with whitespace in JWT roles in OpenSearch

MEDIUM 40

OpenSearch is an open source distributed and RESTful search engine.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00833 Published 2023-01-24 Fixed in 2.5.0, 1.3.8 CWE-287

TI-2023-09442 CVE-2023-23613 · GHSA-v3cg-7r9h-r2g6

Field-level security issue with .keyword fields in OpenSearch

LOW 30

OpenSearch is an open source distributed and RESTful search engine.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00859 Published 2023-01-24 Fixed in 2.5.0, 1.3.8 CWE-200

TI-2022-20259 CVE-2022-41918 · GHSA-wmx7-x4jp-9jgg

Issue with fine-grained access control of indices backing data streams

LOW 29

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00484 Published 2022-11-15 Fixed in 1.3.7, 2.4.0 CWE-612

TI-2022-20258 CVE-2022-41917

Incorrect Error Handling Allowed Partial File Reads Over REST API in OpenSearch

LOW 21

OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00605 Published 2022-11-15 Fixed in 1.3.7, 2.4.0 CWE-200

TI-2022-16405 CVE-2022-35980 · GHSA-f4qr-f4xx-hjxw

OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information

MEDIUM 41

OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01231 Published 2022-08-12 Fixed in 2.2.0.0 CWE-612

TI-2022-13159 CVE-2022-31115 · GHSA-977c-63xq-cgw3

Unsafe YAML deserialization in opensearch-ruby

HIGH 73

opensearch-ruby is a community-driven, open source fork of elasticsearch-ruby.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01617 Published 2022-06-30 Fixed in 2.0.1, 2.0.2 CWE-502

Vulnerabilities

Filters