CVE-2025-68390: Elastic Elasticsearch DOS Vulnerability

CVE-2025-68390 Overview

CVE-2025-68390 is a denial of service vulnerability in Elastic Elasticsearch caused by unbounded resource allocation [CWE-770]. An authenticated user holding snapshot restore privileges can send a crafted HTTP request that triggers excessive memory allocation. The resulting memory exhaustion renders the Elasticsearch node unresponsive and disrupts search and indexing operations.

Elastic published the fix in security advisory ESA-2025-37 covering Elasticsearch versions 8.19.8, 9.1.8, and 9.2.2. The flaw requires high privileges but no user interaction and is exploitable over the network against the Elasticsearch REST API.

Critical Impact
Authenticated attackers with snapshot restore privileges can exhaust node memory and cause service-wide denial of service against Elasticsearch clusters.

Affected Products

Elastic Elasticsearch versions prior to 8.19.8
Elastic Elasticsearch 9.x versions prior to 9.1.8
Elastic Elasticsearch 9.2.x versions prior to 9.2.2

Discovery Timeline

2025-12-18 - CVE-2025-68390 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-68390

Vulnerability Analysis

The vulnerability resides in the snapshot restore code path of Elasticsearch. The server accepts restore requests without enforcing upper limits on the memory allocated to process request parameters or snapshot metadata. An authenticated client supplying a crafted HTTP body can force the node to allocate memory structures beyond safe thresholds.

When the Java Virtual Machine heap approaches its configured limit, the node enters prolonged garbage collection cycles and ultimately becomes unresponsive. Clustered deployments can see cascading failures as the affected node fails health checks and replicas rebalance across remaining nodes.

Root Cause

The root cause is Allocation of Resources Without Limits or Throttling [CWE-770]. The snapshot restore handler does not validate or cap allocation sizes derived from attacker-controlled request fields before committing them to heap memory.

Attack Vector

The vulnerability is exploited over the network against the Elasticsearch HTTP API. The attacker must possess an account with the manage cluster privilege or an equivalent role that authorizes snapshot restore operations. No user interaction is required.

Successful exploitation does not disclose or modify data but reliably triggers memory exhaustion on the targeted node. Technical detail is not included in the public advisory. Refer to the Elastic Security Update ESA-2025-37 for vendor guidance.

Detection Methods for CVE-2025-68390

Indicators of Compromise

Sudden spikes in JVM heap usage on Elasticsearch nodes correlated with incoming snapshot restore API calls.
Repeated POST requests to _snapshot/*/_restore endpoints from a single authenticated principal.
Node unresponsiveness, OutOfMemoryError entries, or long garbage collection pauses in Elasticsearch logs.

Detection Strategies

Audit Elasticsearch security logs for snapshot restore operations initiated by non-administrative service accounts.
Alert when snapshot restore requests are issued outside maintenance windows or by unexpected source IP addresses.
Correlate HTTP API audit events with JVM memory telemetry to detect allocation anomalies in near real time.

Monitoring Recommendations

Enable Elasticsearch audit logging with xpack.security.audit.enabled: true and capture authentication, authorization, and access_granted events.
Forward node metrics and audit logs to a centralized SIEM for cross-node correlation and historical analysis.
Track role assignments for the manage and snapshot_user privileges and alert on new grants.

How to Mitigate CVE-2025-68390

Immediate Actions Required

Upgrade Elasticsearch to version 8.19.8, 9.1.8, or 9.2.2 as applicable to your deployment branch.
Review all role mappings and remove snapshot restore privileges from accounts that do not require them.
Rotate credentials for any service account that was granted broad cluster privileges beyond operational need.

Patch Information

Elastic addressed CVE-2025-68390 in the releases documented in Elastic Security Update ESA-2025-37. Administrators should plan a rolling upgrade to the fixed versions and verify cluster health after each node restart.

Workarounds

Restrict snapshot restore privileges to a small set of trusted administrative accounts using role-based access control.
Place Elasticsearch HTTP endpoints behind a reverse proxy that enforces strict authentication and request body size limits.
Apply network segmentation so that the Elasticsearch API is reachable only from management subnets.

bash

# Example: restrict snapshot restore to a dedicated role
POST /_security/role/snapshot_restore_admin
{
  "cluster": ["manage"],
  "indices": [
    {
      "names": ["*"],
      "privileges": ["all"]
    }
  ]
}

# Enable audit logging in elasticsearch.yml
xpack.security.audit.enabled: true
xpack.security.audit.logfile.events.include: ["access_granted", "authentication_success", "authentication_failed"]