CVE-2025-68390: Elasticsearch x-pack-core Excessive Resource Allocation Vulnerability
Summary
CVE-2025-68390: Elasticsearch privileged authenticated users can cause DoS through Excessive Resource Allocation. Affects org.elasticsearch.plugin:x-pack-core across 3 version ranges.
< 8.19.8
>= 9.0.0, < 9.1.8
>= 9.2.0, < 9.2.2
Fixed in 8.19.8, 9.1.8 or 9.2.2, depending on the release line you run. How to fix ↓
Also tracked for
- elasticsearch · Bitnami
The same CVE-2025-68390 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Elasticsearch is a powerful open-source search and analytics engine designed for horizontal scalability, reliability, and real-time search capabilities. The x-pack-core plugin enhances Elasticsearch with features such as security, monitoring, and alerting. However, it is susceptible to a vulnerability that allows authenticated users with snapshot restore privileges to allocate excessive resources, leading to potential denial of service (DoS).
Vulnerability Detail
The vulnerability arises from the lack of limits or throttling on resource allocation within Elasticsearch. Authenticated users with specific privileges can exploit this flaw by sending crafted HTTP requests that trigger excessive memory allocation. This can lead to a denial of service, where the system becomes unresponsive due to resource exhaustion. The vulnerability is classified under CWE-770, indicating a failure to impose limits on resource usage.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.19.88.19.8 -
>= 9.0.0, < 9.1.89.1.8 -
>= 9.2.0, < 9.2.29.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can limit the privileges of users who have access to snapshot restore capabilities, thereby reducing the risk of exploitation until the package is updated.
Conclusion
The CVE-2025-68390 vulnerability in the Elasticsearch x-pack-core plugin poses a risk of denial of service through excessive resource allocation by authenticated users. It is crucial to update to the latest patched versions to mitigate this risk and ensure system stability.
See every vulnerability recorded for org.elasticsearch.plugin:x-pack-core →
FAQ
CVE-2025-68390 is a vulnerability in the Elasticsearch x-pack-core plugin that allows authenticated users to cause excessive resource allocation, potentially leading to a denial of service.
Any Elasticsearch installation using the x-pack-core plugin with users having snapshot restore privileges is at risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Consider limiting user privileges related to snapshot restoration as a temporary workaround until you can apply the necessary updates.
The CVSS score for this vulnerability is 4.9, indicating a moderate severity level.
