CVE-2026-75897
Awaiting Analysis Awaiting Analysis - Queue

Improper Input Validation in OpenSearch Dashboards Leads to DoS

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: AMZN

Description
Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-09-07
AI Q&A
2026-08-18
EPSS Evaluated
2026-09-06
NVD
CVE-2026-75897
EUVD
EUVD-2026-61064

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opensearch dashboards *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1284 The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper input validation in OpenSearch Dashboards' capabilities route handler. The system fails to limit the size of HTTP request payloads, allowing remote attackers to send oversized requests that consume excessive server resources. This can lead to a denial-of-service condition where the service becomes unavailable due to resource exhaustion.

Detection Guidance

Monitor network traffic for unusually large HTTP requests targeting OpenSearch Dashboards endpoints. Check logs for repeated requests to the capabilities route handler. Use tools like Wireshark or tcpdump to capture and analyze payload sizes. Ensure your IDS/IPS is configured to detect anomalies in request sizes.

Impact Analysis
  • Service disruption: Your OpenSearch Dashboards instance may become unresponsive or crash due to resource exhaustion from crafted requests.
  • Downtime: The vulnerability could cause prolonged unavailability of critical data visualization and management tools.
  • Increased operational costs: Mitigation efforts like upgrading or deploying additional security layers may require resources.
Compliance Impact

This vulnerability could impact compliance by causing service disruptions that violate availability requirements in GDPR (Article 32) and HIPAA (Security Rule §164.312). Unplanned downtime may lead to unauthorized access or data breaches if security controls are bypassed during resource exhaustion.

Mitigation Strategies

Upgrade OpenSearch Dashboards to version 3.8.0 or later. For AWS Managed OpenSearch Service, apply the latest service software update. Deploy an authentication layer like a reverse proxy or restrict network access to trusted sources. Monitor the OpenSearch Service console for update notifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75897. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart