CVE-2025-68390 — Allocation of Resources Without Limits or Throttling in Elasticsearch
Severity
4.9MEDIUMNVD
EPSS
0.2%
top 60.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 18
Latest updateDec 19
Description
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory and a denial of service (DoS) via crafted HTTP request.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HExploitability: 1.2 | Impact: 3.6
Affected Packages2 packages
🔴Vulnerability Details
4OSV▶
Elasticsearch privileged authenticated users can cause DoS through Excessive Resource Allocation↗2025-12-19
GHSA▶
Elasticsearch privileged authenticated users can cause DoS through Excessive Resource Allocation↗2025-12-19
OSV▶
CVE-2025-68390: Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to ca↗2025-12-18