CVE-2023-31419
Elasticsearch StackOverflow vulnerability
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Elasticsearch StackOverflow vulnerability
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.
- Record
CVE-2023-31419- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-121
- Updated
- 2026-11-02
EUVDEUVD-2023-2797
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.
- Record
EUVD-2023-2797- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qwrx-45xf-jjf7
Elasticsearch vulnerable to stack overflow in the search API
A flaw was discovered in Elasticsearch affecting the _search API that allowed a specially crafted query string to cause a stack overflow and ultimately a denial of service.
- Record
GHSA-qwrx-45xf-jjf7- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-121, CWE-787
- Updated
- 2026-11-02
NVD
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.
- Record
CVE-2023-31419- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-121, CWE-787
- Updated
- 2026-11-02
OSV
Elasticsearch StackOverflow vulnerability
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.
- Record
CVE-2023-31419- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-121
- Updated
- 2026-11-02
OSVGHSA-qwrx-45xf-jjf7
Elasticsearch vulnerable to stack overflow in the search API
A flaw was discovered in Elasticsearch affecting the _search API that allowed a specially crafted query string to cause a stack overflow and ultimately a denial of service.
- Record
GHSA-qwrx-45xf-jjf7- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-121, CWE-787
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-31419
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.
- Record
UBUNTU-CVE-2023-31419- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-elasticsearch-2023-31419 No score
Elasticsearch StackOverflow vulnerability
A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.
- Record
BIT-elasticsearch-2023-31419- Updated
- 2026-11-02
OSVCLSA-2026-1783472555 No score
TuxCare security update for org.elasticsearch:elasticsearch (3 CVEs)
TuxCare rebuilt org.elasticsearch:elasticsearch to address 3 CVEs. Fixed in 7.16.3-tuxcare.1.
- Record
CLSA-2026-1783472555- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.elasticsearch:elasticsearchMaven |
7.0.0 up to 7.17.13 | 7.17.13 |
org.elasticsearch:elasticsearchMaven |
8.0.0 up to 8.9.1 | 8.9.1 |
elasticsearchBitnami |
7.0.0 up to 7.17.13, 8.0.0 up to 8.9.1 | 7.17.138.9.1 |
org.elasticsearch:elasticsearchTuxCare:Maven From an advisory covering 3 CVEs |
7.16.3 up to 7.16.3-tuxcare.1 | 7.16.3-tuxcare.1 |
org.elasticsearch:elasticsearchMaven |
7.0.0 up to 7.17.13, plus listed versions 7.0.17.1.07.1.17.10.07.10.1 Show 45 moreShow less7.10.27.11.07.11.17.11.27.12.07.12.17.13.07.13.17.13.27.13.37.13.47.14.07.14.17.14.27.15.07.15.17.15.27.16.07.16.17.16.27.16.37.17.07.17.17.17.107.17.117.17.127.17.27.17.37.17.47.17.57.17.67.17.77.17.87.17.97.2.07.2.17.3.07.3.17.3.27.4.07.4.17.4.27.5.07.5.17.5.2 |
7.17.13 |
org.elasticsearch:elasticsearchMaven |
8.0.0 up to 8.9.1, plus listed versions 8.0.18.1.08.1.18.1.28.1.3 Show 25 moreShow less8.2.08.2.18.2.28.2.38.3.08.3.18.3.28.3.38.4.08.4.18.4.28.4.38.5.08.5.18.5.28.5.38.6.08.6.18.6.28.7.08.7.18.8.08.8.18.8.28.9.0 |
8.9.1 |
elasticsearchUbuntu:16.04:LTS |
All versions, plus listed versions 1.6.2+dfsg-11.7.3+dfsg-11.7.3+dfsg-21.7.3+dfsg-3 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | sqrtZeroKnowledge/Elasticsearch-Exploit-CVE-2023-31419 | 2023-09-22 |
| PoC in GitHub | u238/Elasticsearch-CVE-2023-31419 | 2023-10-03 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-31419 is a medium vulnerability (CVSS 6.5) in Elastic Elasticsearch, published October 26, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 61.1%, the 99th percentile. Fixed in org.elasticsearch:elasticsearch 7.17.13.
References
discuss.elastic.co/t/elasticsearch-8-9-1-7-17-13-security-update/343297
elastic.co/community/security
security.netapp.com/advisory/ntap-20231116-0010
nvd.nist.gov/vuln/detail/CVE-2023-31419
github.com/advisories/GHSA-qwrx-45xf-jjf7
ubuntu.com/security/CVE-2023-31419
cve.org/CVERecord?id=CVE-2023-31419
Left out here: 11 versions. The JSON record has them.