CVE-2025-68384: Elastic Elasticsearch DOS Vulnerability

CVE-2025-68384 Overview

CVE-2025-68384 is a denial-of-service vulnerability in Elastic Elasticsearch. The flaw stems from unbounded resource allocation (CWE-770) when processing user settings data. A low-privileged authenticated user can submit oversized settings payloads, triggering an out-of-memory (OOM) condition that crashes the node persistently.

Elastic published the fix in the ESA-2025-33 advisory, covering Elasticsearch 8.19.9, 9.0.9, 9.1.9, and 9.2.3. The vulnerability requires authentication but no user interaction, and attacks originate over the network.

Critical Impact
An authenticated attacker with minimal privileges can crash Elasticsearch nodes repeatedly, disrupting search, indexing, and dependent application services.

Affected Products

Elastic Elasticsearch versions prior to 8.19.9
Elastic Elasticsearch 9.x versions prior to 9.0.9, 9.1.9
Elastic Elasticsearch 9.2.x prior to 9.2.3

Discovery Timeline

2025-12-18 - CVE-2025-68384 published to the National Vulnerability Database (NVD)
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2025-68384

Vulnerability Analysis

The vulnerability resides in the Elasticsearch component responsible for handling user settings submissions. The code path accepts settings payloads without enforcing size limits or allocation throttling. When a client submits an oversized settings document, Elasticsearch allocates memory proportional to the input, exhausting the Java Virtual Machine (JVM) heap.

The resulting out-of-memory error crashes the Elasticsearch node. Because the oversized settings data may be persisted, restart attempts can reload the malicious payload and trigger a repeat crash. This produces a persistent denial of service rather than a transient outage.

Exploitation requires only low-level authenticated access. Standard application users holding settings-write privileges meet the bar, which broadens the attacker population beyond administrators.

Root Cause

The root cause is Allocation of Resources Without Limits or Throttling (CWE-770). The settings handler lacks input-size validation and does not enforce memory ceilings on deserialized objects. This is a textbook Excessive Allocation pattern (CAPEC-130) in which attacker-controlled input directly governs allocation size.

Attack Vector

An authenticated attacker submits a crafted REST API request containing an oversized user settings payload. The target node parses and allocates memory for the payload, consumes available heap, and terminates. Because the input persists in cluster state, cluster recovery may re-trigger the crash across restarts and across other nodes attempting to apply the state.

No verified public exploit code is available. See the Elastic Discuss Security Update ESA-2025-33 for vendor technical details.

Detection Methods for CVE-2025-68384

Indicators of Compromise

Elasticsearch node logs showing OutOfMemoryError or java.lang.OutOfMemoryError: Java heap space entries
Unexpected node crashes or restarts correlated with REST API requests targeting user settings endpoints
Cluster state updates containing abnormally large settings documents from non-administrative accounts

Detection Strategies

Monitor Elasticsearch audit logs for settings-write API calls from low-privilege users and alert on payload sizes exceeding expected baselines
Correlate JVM heap utilization spikes with specific user sessions and source IP addresses
Review cluster state size trends; sudden growth in settings-related fields warrants investigation

Monitoring Recommendations

Enable Elasticsearch audit logging with request body capture for settings endpoints
Forward JVM metrics and node restart events to a centralized SIEM for correlation
Baseline normal settings payload sizes per user role to tune anomaly thresholds

How to Mitigate CVE-2025-68384

Immediate Actions Required

Upgrade Elasticsearch to version 8.19.9, 9.0.9, 9.1.9, or 9.2.3 as applicable to your deployment
Audit user accounts holding settings-write privileges and revoke access that is not operationally required
Review recent cluster state for oversized settings documents and remove any that appear anomalous

Patch Information

Elastic released patches in Elasticsearch 8.19.9, 9.0.9, 9.1.9, and 9.2.3. The fix is documented in Elastic Security Advisory ESA-2025-33. Apply the upgrade across all nodes in the cluster and validate cluster health after rollout.

Workarounds

Restrict access to settings-modification APIs using role-based access control until patching is complete
Place a reverse proxy or API gateway in front of Elasticsearch to enforce request body size limits
Monitor JVM heap and set operating-system-level restart policies to accelerate recovery if a crash occurs

bash

# Example: enforce a request body size limit at an NGINX reverse proxy
# fronting Elasticsearch to blunt oversized settings payloads
http {
    client_max_body_size 1m;

    server {
        listen 9200;
        location / {
            proxy_pass http://elasticsearch_backend;
        }
    }
}