Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.elasticsearch.plugin:x-pack-security

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.5MavenPublished

    Elasticsearch has Excessive Allocation of Resources via Submission of Oversized User Settings Data

    CVE-2025-68384 · GHSA-qf7c-7r9h-mm92

    Affected
    • Maven org.elasticsearch.plugin:x-pack-security < 8.19.9; >= 9.0.0, < 9.1.9; >= 9.2.0, < 9.2.3
    Fixed in
    8.19.99.1.99.2.3· Vendor fix available
    Issue
    Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.

    Recommended action: Upgrade to 9.2.3, 9.1.9 or 8.19.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 6.8MavenPublished

    Elasticsearch PKI Realm Authentication Bypass Vulnerability Allows User Impersonation Through Crafted Client Certificates

    CVE-2025-37731 · GHSA-m9gh-789g-q5pv

    Affected
    • Maven org.elasticsearch.plugin:x-pack-security >= 7.0.0-alpha1, < 8.19.8; >= 9.0.0-beta1, < 9.1.8; >= 9.2.0, < 9.2.2
    Fixed in
    9.1.88.19.89.2.2· Vendor fix available
    Issue
    Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.

    Recommended action: Upgrade to 9.2.2, 9.1.8 or 8.19.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →