Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.elasticsearch.plugin:x-pack-core

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.9MavenPublished

    Elasticsearch privileged authenticated users can cause DoS through Excessive Resource Allocation

    CVE-2025-68390 · GHSA-gphj-4h6p-37xq

    Affected
    • Maven org.elasticsearch.plugin:x-pack-core < 8.19.8; >= 9.0.0, < 9.1.8; >= 9.2.0, < 9.2.2
    Fixed in
    9.1.88.19.89.2.2· Vendor fix available
    Issue
    Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory and a denial of service (DoS) via crafted HTTP request.

    Recommended action: Upgrade to 9.2.2, 9.1.8 or 8.19.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 6.8MavenPublished

    Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates

    CVE-2025-37731 · GHSA-m9gh-789g-q5pv

    Affected
    • Maven org.elasticsearch.plugin:x-pack-core >= 7.0.0-alpha1, < 8.19.8; >= 9.0.0-beta1, < 9.1.8; >= 9.2.0, < 9.2.2
    Fixed in
    9.1.88.19.89.2.2· Vendor fix available
    Issue
    Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.

    Recommended action: Upgrade to 9.2.2, 9.1.8 or 8.19.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →