CVE-2025-68384
Elasticsearch Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Elasticsearch Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.
- Record
CVE-2025-68384- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2025-204411
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.
- Record
EUVD-2025-204411- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qf7c-7r9h-mm92
Elasticsearch has Excessive Allocation of Resources via Submission of Oversized User Settings Data
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.
- Record
GHSA-qf7c-7r9h-mm92- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.
- Record
CVE-2025-68384- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
Elasticsearch Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.
- Record
CVE-2025-68384- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-qf7c-7r9h-mm92
Elasticsearch has Excessive Allocation of Resources via Submission of Oversized User Settings Data
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.
- Record
GHSA-qf7c-7r9h-mm92- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2025-68384
CVE-2025-68384 in io.root.org.elasticsearch.plugin:x-pack-security - Patched by Root
Root has patched CVE-2025-68384 in the io.root.org.elasticsearch.plugin:x-pack-security package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2025-68384- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-68384
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.
- Record
UBUNTU-CVE-2025-68384- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-elasticsearch-2025-68384 No score
Elasticsearch Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.
- Record
BIT-elasticsearch-2025-68384- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.elasticsearch.plugin:x-pack-securityMaven |
before 8.19.9 | 8.19.9 |
org.elasticsearch.plugin:x-pack-securityMaven |
9.0.0 up to 9.1.9 | 9.1.9 |
org.elasticsearch.plugin:x-pack-securityMaven |
9.2.0 up to 9.2.3 | 9.2.3 |
elasticsearchBitnami |
before 8.19.9, 9.0.0 up to 9.1.9, 9.2.0 up to 9.2.3 | 8.19.99.1.99.2.3 |
org.elasticsearch.plugin:x-pack-securityMaven |
before 8.19.9, plus listed versions 6.8.116.8.126.8.136.8.146.8.15 Show 45 moreShow less6.8.166.8.176.8.186.8.196.8.206.8.216.8.226.8.237.10.07.10.17.10.27.11.07.11.17.11.27.12.07.12.17.13.07.13.17.13.27.13.37.13.47.14.07.14.17.14.27.15.07.15.17.15.27.16.07.16.17.16.27.16.37.17.07.17.17.17.107.17.117.17.127.17.137.17.147.17.157.17.167.17.177.17.187.17.197.17.27.17.20 |
8.19.9 |
org.elasticsearch.plugin:x-pack-securityMaven |
9.0.0 up to 9.1.9, plus listed versions 9.0.19.0.29.0.39.0.49.0.5 Show 12 moreShow less9.0.69.0.79.0.89.1.09.1.19.1.29.1.39.1.49.1.59.1.69.1.79.1.8 |
9.1.9 |
org.elasticsearch.plugin:x-pack-securityMaven |
9.2.0 up to 9.2.3, plus listed versions 9.2.19.2.2 |
9.2.3 |
io.root.org.elasticsearch.plugin:x-pack-securityRoot:Maven |
before 9.2.0-root.io.1 | 9.2.0-root.io.19.1.3-root.io.19.1.3-root.io.29.2.2-root.io.19.2.0-root.io.29.1.3-root.io.39.2.2-root.io.2 |
org.elasticsearch.plugin:x-pack-securityRoot:Maven |
before 9.2.0-aikido.2 | 9.2.0-aikido.29.1.3-aikido.39.2.2-aikido.2 |
elasticsearchUbuntu:16.04:LTS |
All versions, plus listed versions 1.6.2+dfsg-11.7.3+dfsg-11.7.3+dfsg-21.7.3+dfsg-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-68384 is a medium vulnerability (CVSS 6.5) in Elastic Elasticsearch, published December 18, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in org.elasticsearch.plugin:x-pack-security 8.19.9.
References
discuss.elastic.co/t/elasticsearch-8-19-9-9-1-9-and-9-2-3-security-update-esa-2025-33/384181
nvd.nist.gov/vuln/detail/CVE-2025-68384
github.com/elastic/elasticsearch/pull/138691
Left out here: 123 versions. The JSON record has them.