{"id":"CVE-2023-31419","published":"2023-10-26T17:06:14Z","modified":"2025-02-13T16:50:07Z","title":"Elasticsearch StackOverflow vulnerability","vendor":"Elastic","product":"Elasticsearch","tier":"core","eol":null,"affectedVersions":[{"vendor":"Elastic","product":"Elasticsearch","versions":[">= 7.0.0, < 7.17.12",">= 8.0.0, < 8.9.0"]}],"description":{"text":"A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is a stack overflow in the _search API of Elastic's Elasticsearch, triggered when the server processes a specially crafted query string. The attacker needs to be able to send search requests to the API, and the exploit requires low privileges and no user interaction, resulting in a denial of service.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:29Z"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.61069,"percentile":0.99158,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-121","name":"Stack-based Buffer Overflow"}],"references":[{"url":"https://discuss.elastic.co/t/elasticsearch-8-9-1-7-17-13-security-update/343297","tags":[]},{"url":"https://www.elastic.co/community/security","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20231116-0010/","tags":[]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Maven","package":"org.elasticsearch:elasticsearch","vulnerableRanges":[">=7.0.0, <7.17.13",">=8.0.0, <8.9.1"],"patched":["7.17.13","8.9.1"],"from":["GHSA-qwrx-45xf-jjf7"],"provenance":"source"}],"advisories":[{"id":"GHSA-qwrx-45xf-jjf7","url":"https://github.com/advisories/GHSA-qwrx-45xf-jjf7","severity":"MODERATE","ecosystem":"Maven","package":"org.elasticsearch:elasticsearch","vulnerableRanges":[">=7.0.0, <7.17.13"],"patched":["7.17.13"],"provenance":"source","from":"GHSA"},{"id":"GHSA-qwrx-45xf-jjf7","url":"https://github.com/advisories/GHSA-qwrx-45xf-jjf7","severity":"MODERATE","ecosystem":"Maven","package":"org.elasticsearch:elasticsearch","vulnerableRanges":[">=8.0.0, <8.9.1"],"patched":["8.9.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-2797","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2797","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":0,"earliest":"2023-09-22","earliestUrl":"https://github.com/sqrtZeroKnowledge/Elasticsearch-Exploit-CVE-2023-31419","repos":[{"name":"sqrtZeroKnowledge/Elasticsearch-Exploit-CVE-2023-31419","url":"https://github.com/sqrtZeroKnowledge/Elasticsearch-Exploit-CVE-2023-31419","stars":17,"created":"2023-09-22"},{"name":"u238/Elasticsearch-CVE-2023-31419","url":"https://github.com/u238/Elasticsearch-CVE-2023-31419","stars":0,"created":"2023-10-03"}]},"first":{"date":"2023-09-22","source":"PoC-in-GitHub","url":"https://github.com/sqrtZeroKnowledge/Elasticsearch-Exploit-CVE-2023-31419"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-09-22","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/sqrtZeroKnowledge/Elasticsearch-Exploit-CVE-2023-31419","provenance":"source"},{"date":"2023-10-26","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-31419","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":29.4,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.83,"detail":"percentile 0.9916"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":4.55,"detail":"base score 6.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2022-23708","published":"2022-03-03","fixed":"7.17.1","kev":false,"link":{"from":"CVE-2022-23708","to":"CVE-2023-31419","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.elasticsearch:elasticsearch","fromFixed":"7.17.1","toFixed":"7.17.13","daysApart":602}]}},{"cve":"CVE-2022-23712","published":"2022-06-06","fixed":"8.2.1","kev":false},{"cve":"CVE-2023-31418","published":"2023-10-26","fixed":"8.9.0","kev":false,"link":{"from":"CVE-2023-31418","to":"CVE-2023-31419","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.elasticsearch:elasticsearch","fromFixed":"8.9.0","toFixed":"8.9.1","daysApart":0}]}},{"cve":"CVE-2023-31419","published":"2023-10-26","fixed":"8.9.1","kev":false},{"cve":"CVE-2023-31417","published":"2023-10-26","fixed":"8.9.2","kev":false,"link":{"from":"CVE-2023-31419","to":"CVE-2023-31417","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.elasticsearch:elasticsearch","fromFixed":"8.9.1","toFixed":"8.9.2","daysApart":0}]}},{"cve":"CVE-2023-46673","published":"2023-11-22","fixed":"8.10.3","kev":false},{"cve":"CVE-2024-23449","published":"2024-03-29","fixed":"8.11.1","kev":false}],"package":"Maven:org.elasticsearch:elasticsearch"}}