GHSA-6g3j-p5g6-992f
OpenSearch StackOverflow vulnerability
Impact
A flaw was discovered in OpenSearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.
The issue was identified by Elastic Engineering and corresponds to security advisory ESA-2023-14 (CVE-2023-31419).
Mitigation
Versions 1.3.14 and 2.11.1 contain a fix for this issue.
For more information
If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
What each source reports
GitHub Advisories Score used
OpenSearch StackOverflow vulnerability
Impact
A flaw was discovered in OpenSearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.
The issue was identified by Elastic Engineering and corresponds to security advisory ESA-2023-14 (CVE-2023-31419).
Mitigation
Versions 1.3.14 and 2.11.1 contain a fix for this issue.
For more information
If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
- Record
GHSA-6g3j-p5g6-992f- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
OpenSearch StackOverflow vulnerability
Impact
A flaw was discovered in OpenSearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.
The issue was identified by Elastic Engineering and corresponds to security advisory ESA-2023-14 (CVE-2023-31419).
Mitigation
Versions 1.3.14 and 2.11.1 contain a fix for this issue.
For more information
If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
- Record
GHSA-6g3j-p5g6-992f- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.opensearch:opensearchMaven | before 1.3.14 | 1.3.14 |
org.opensearch:opensearchMaven | 2.0.0 up to 2.11.1 | 2.11.1 |
org.opensearch:opensearchMaven | before 1.3.14, plus listed versions 1.0.01.1.01.2.01.2.11.2.2 Show 16 moreShow less1.2.31.2.41.3.01.3.11.3.101.3.111.3.121.3.131.3.21.3.31.3.41.3.51.3.61.3.71.3.81.3.9 | 1.3.14 |
org.opensearch:opensearchMaven | 2.0.0 up to 2.11.1, plus listed versions 2.0.12.1.02.10.02.11.02.2.0 Show 9 moreShow less2.2.12.3.02.4.02.4.12.5.02.6.02.7.02.8.02.9.0 | 2.11.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-6g3j-p5g6-992f is a medium vulnerability (CVSS 6.5) in org.opensearch:opensearch, published December 1, 2023. No source lists public exploit code. Fixed in org.opensearch:opensearch 1.3.14.