BaseFortify

Publication date: 2025-12-18

Last updated on: 2025-12-23

Assigner: Elastic

Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory and a denial of service (DoS) via crafted HTTP request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-18

Last Modified

2025-12-23

Generated

2026-07-06

AI Q&A

2025-12-19

EPSS Evaluated

2026-07-05

NVD

CVE-2025-68390

EUVD

EUVD-2025-204407

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	From 7.0.0 (inc) to 7.17.29 (inc)
elastic	elasticsearch	From 8.0.0 (inc) to 8.19.8 (exc)
elastic	elasticsearch	From 9.0.0 (inc) to 9.1.8 (exc)
elastic	elasticsearch	From 9.2.0 (inc) to 9.2.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in Elasticsearch involves allocation of resources without limits or throttling (CWE-770). An authenticated user who has snapshot restore privileges can send a specially crafted HTTP request that causes excessive memory allocation (CAPEC-130), potentially leading to a denial of service (DoS).

Impact Analysis

The vulnerability can impact you by allowing an authenticated user with snapshot restore privileges to cause excessive memory usage on the Elasticsearch server, which can lead to a denial of service (DoS). This can disrupt availability of the service.

Hi! I’m here to help you understand CVE-2025-68390. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70