CVE-2025-68384: Excessive Resource Allocation in org.elasticsearch.plugin:x-pack-security
Summary
CVE-2025-68384: Elasticsearch has Excessive Allocation of Resources via Submission of Oversized User Settings Data. Affects org.elasticsearch.plugin:x-pack-security across 3 version ranges.
< 8.19.9
>= 9.0.0, < 9.1.9
>= 9.2.0, < 9.2.3
Fixed in 8.19.9, 9.1.9 or 9.2.3, depending on the release line you run. How to fix ↓
Also tracked for
- elasticsearch · Bitnami
The same CVE-2025-68384 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.elasticsearch.plugin:x-pack-security package is a crucial component of the Elasticsearch ecosystem, providing security features such as authentication, authorization, and encryption. It is widely used in applications that require robust search and analytics capabilities. However, this package is vulnerable to excessive resource allocation, which can lead to denial of service (DoS) attacks if exploited by low-privileged authenticated users.
Vulnerability Detail
The vulnerability arises from the lack of limits or throttling on resource allocation within Elasticsearch. Specifically, it allows authenticated users to submit oversized user settings data, which can lead to excessive resource consumption and ultimately cause the application to crash due to out-of-memory (OOM) errors. This vulnerability is classified under CWE-770, indicating a failure to manage resource allocation effectively, and can be exploited to disrupt service availability.
How To Fix
Latest published version: 9.5.5 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.19.98.19.9 -
>= 9.0.0, < 9.1.99.1.9 -
>= 9.2.0, < 9.2.39.2.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider implementing input validation to restrict the size of user settings data submitted by authenticated users. This can help mitigate the risk of excessive resource allocation until the package is updated.
Conclusion
In summary, CVE-2025-68384 presents a significant risk to applications using the org.elasticsearch.plugin:x-pack-security package due to excessive resource allocation. It is crucial to update to the patched versions to ensure the security and availability of your application.
See every vulnerability recorded for org.elasticsearch.plugin:x-pack-security →
FAQ
CVE-2025-68384 is a vulnerability in the org.elasticsearch.plugin:x-pack-security package that allows low-privileged authenticated users to cause excessive resource allocation, leading to potential denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to out-of-memory crashes, resulting in a denial of service and affecting the availability of your application.
The safe versions of the org.elasticsearch.plugin:x-pack-security package are 8.19.9, 9.1.9, and 9.2.3. Updating to any of these versions will mitigate the vulnerability.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just the pom.xml file, providing real-time insights without requiring code access.
