What’s Vulnerable › Vulnerabilities

CVE-2023-31418: Elasticsearch uncontrolled resource consumption

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-26 · updated 2026-06-17
• Weakness: CWE-400

Description

An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering and we have no indication that the issue is known or that it is being exploited in the wild.

Affected products

• Elastic Cloud Enterprise: through 2.13.3; 3.6.0
• Elasticsearch: through 7.17.12; from 8.0.0 through 8.8.2

References

• https://discuss.elastic.co/t/elasticsearch-8-9-0-7-17-13-security-update/343616
• https://security.netapp.com/advisory/ntap-20231130-0005/
• https://www.elastic.co/community/security
• https://discuss.elastic.co/t/elasticsearch-8-9-0-7-17-13-security-update/343616
• https://security.netapp.com/advisory/ntap-20231130-0005/
• https://www.elastic.co/community/security

Get alerted when CVE-2023-31418 or the next vulnerability affects your stack