Resource exhaustion in Elastic Elastic_cloud_enterprise
CVE-2023-31418
An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP req…
Vulnerability class: DoS (Denial of Service)
EPSS: 0.012 (65.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Elastic Elastic_cloud_enterprise — versions 3.6.0
- Elastic Elasticsearch — versions 7.17.12, 8.0.0, 2.13.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@elastic.co (Vendor Advisory)
- security@elastic.co (Vendor Advisory)
- security@elastic.co
Frequently asked questions
- What is CVE-2023-31418?
- CVE-2023-31418 is a high-severity vulnerability in Elastic Elastic_cloud_enterprise, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2023-10-26.
- How severe is CVE-2023-31418?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2023-31418 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.