CVE-2025-68390: elastic elasticsearch
CVSS: 4.9v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2025-68390CGA-32hc-p9wp-p5q4CGA-4cxq-q5p4-7rr6CGA-969g-xcj4-rcfcCGA-c95v-wcmv-3hq7CGA-gxhj-37wc-8x5vCGA-h9x7-vrq9-g24pCGA-jv7v-8f3p-w86jCGA-mgq6-f758-c8f7CGA-pphg-684q-cm44CGA-qqx9-6xrp-76hcCGA-rjgh-284p-3xjcCGA-v342-cwpj-rm5pCGA-x44r-vm2w-6w54CGA-x825-4hgm-gxxhCGA-2g5f-pq69-wph4CGA-2vqc-rm5p-2pc2CGA-339m-89xf-cg2rCGA-43q4-fw84-3w76CGA-499g-wg7f-wqq7CGA-4fpc-wqvc-f7qrCGA-4w4x-hjcf-m54qCGA-53v4-2r5p-3wp6CGA-5664-qwmg-vrfqCGA-56hm-mx63-9q22CGA-58fp-7cg5-7629CGA-5998-3363-x8cgCGA-5g4w-vw69-w633CGA-5hhh-pr6w-7gm8CGA-5m6m-pp2g-jw2cCGA-6chw-h66m-mwqqCGA-6rf5-wr32-wcj2CGA-72rc-r6qf-3c9vCGA-879h-8j3h-6qv8CGA-9ch6-53m4-rmj8CGA-c3fm-6hm4-c539CGA-c3w3-cx7g-2634CGA-c89h-j2q7-76cpCGA-c89x-j52h-w8v8CGA-chp2-84rq-mq22CGA-cmfw-wpm6-2785CGA-ff2v-hmhf-rv8qCGA-g2m4-xp84-3fgmCGA-g3p8-7q5f-85h4CGA-gppj-7mhw-42p9CGA-hjvp-5rrj-9w9fCGA-jxjw-73vw-7hjjCGA-mjm3-w782-7p85CGA-mm92-qx68-chwwCGA-p3hw-grmv-v56jCGA-p8hm-f36h-m436CGA-phf8-hr39-3jp2GHSA-gphj-4h6p-37xqBIT-elasticsearch-2025-68390CGA-pwcx-ggjp-m3w9CGA-q5pm-pv78-767rCGA-qf2w-wxf5-28pqCGA-qpmj-x37w-6rwrCGA-qr57-qjpf-xg46CGA-r6gw-pwpg-52xfCGA-vhp3-h53c-wx5rCGA-vxc3-9gh3-jq8mCGA-wgm8-7pqg-78p8CGA-wp9w-446f-2xgxCGA-wpjx-hhh9-696fCGA-ww8m-4q92-87jgCGA-xh2g-59xc-9mrp
Published 18-12-2025Last modified 19-12-2025
Vulnerability summary
CVE-2025-68390 is a medium (CVSS 4.9) vulnerability in elastic elasticsearch. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 30.1% of scored vulnerabilities.
CVSS score
4.9/10
010
Medium · v3.1 (CVE.org)EPSS score
0.38%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 18-12-2025PublishedVulnerability first disclosed.
- 19-12-2025Last modifiedVulnerability information updated.
Description
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory and a denial of service (DoS) via crafted HTTP request.
CVSS metrics
6 scores · 6 sources · 1 versionMedium 4.9Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- OSV · MavenEcosystem advisory · calculated4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- NVDNIST4.9MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
30%
Versus all other CVEs
30-day change
0.00 pp
From 0.38% on 18-09-2026
18-09-202618-10-2026
EPSS score0.38%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard23 products
- commercial-elasticsearch-8.17All versions (No fix recorded)
- commercial-elasticsearch-8.18All versions (No fix recorded)
- commercial-elasticsearch-9.0All versions (No fix recorded)
- elasticsearch-7All versions (No fix recorded)
- elasticsearch-7-iamguardedAll versions (No fix recorded)
Wolfi7 products
- ruby3.2-elasticsearchAll versions (No fix recorded)
- ruby3.3-elasticsearchAll versions (No fix recorded)
- ruby3.4-elasticsearchAll versions (No fix recorded)
- ruby4.0-elasticsearch< 9.3.0-r0
- sonarqube< 25.12.0.117093-r0
Elastic1 product
- elasticsearch≥ 8.0.0, ≤ 8.19.7 | ≥ 9.0.0, ≤ 9.1.7 | ≥ 9.2.0, ≤ 9.2.1 | ≥ 7.0.0, ≤ 7.17.29 | ≥ 8.0.0, < 8.19.8 | ≥ 9.0.0, < 9.1.8 | ≥ 9.2.0, < 9.2.2
Org.elasticsearch.plugin1 product
- x-pack-core< 8.19.8 | ≥ 9.0.0, < 9.1.8 | ≥ 9.2.0, < 9.2.2
Ubuntu1 product
- elasticsearchAll versions (No fix recorded)
5 vendors · 33 products
References
7 links- discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-37/384185REPORTWEBVendor Advisory
