CVE-2025-68384: Elasticsearch Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68384?
CVE-2025-68384 is considered to have a high severity due to its potential to cause a denial of service.
How do I fix CVE-2025-68384?
To fix CVE-2025-68384, you should update Elasticsearch to the latest version where the vulnerability has been patched.
Who is affected by CVE-2025-68384?
Users of Elasticsearch, specifically those who allow low-privileged authenticated users to submit oversized user settings, are affected by CVE-2025-68384.
What type of vulnerability is CVE-2025-68384?
CVE-2025-68384 is an allocation of resources without limits or throttling vulnerability.
What can an attacker do with CVE-2025-68384?
An attacker exploiting CVE-2025-68384 can cause excessive allocation of resources, leading to an out-of-memory crash and denial of service.