CVE-2025-9624
CVE-2025-9624 · OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A vulnerability in OpenSearch allows attackers to cause Denial of Service (DoS) by submitting complex query_string inputs. This issue affects all OpenSearch versions between 3.0.0 and < 3.3.0 and OpenSearch < 2.19.4.
CVSS 8.3 · High · EPSS 0.7% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
opensearch
- Versions
- ≥ 3.0.0, < 3.3.0: Affected (custom)
- ≥ 1.0.0, < 2.19.4: Affected (custom)
Update to 2.19.4; Update to 3.3.0
opensearch Ubuntu:24.04:LTS
- Versions
- 2.4.1+dfsg-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published