CVE-2023-31418 Elasticsearch uncontrolled resource consumption
An unauthenticated attacker can cause Elasticsearch to crash via OutOfMemory errors by sending malformed HTTP requests, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-31418?
CVE-2023-31418 is a high-severity denial of service vulnerability in Elastic Elasticsearch, published on 26 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering and we have no indication that the issue is known or that it is being exploited in the wild.
Weakness: CWE-400
Which versions are affected by CVE-2023-31418?
5 open source packages ship an affected version, including org.elasticsearch:elasticsearch and elasticsearch. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.elasticsearch:elasticsearch Maven | All versions | 7.17.13 |
org.elasticsearch:elasticsearch Maven | All versions | 7.17.13 |
org.elasticsearch:elasticsearch Maven | From 8.0.0 | 8.9.0 |
org.elasticsearch:elasticsearch Maven | From 8.0.0 | 8.9.0 |
elasticsearch Bitnami | All versions | 7.17.13, 8.8.3 |
Products include Elastic Elastic Cloud Enterprise, Elastic Elasticsearch.
How do I fix CVE-2023-31418?
Upgrade org.elasticsearch:elasticsearch to a fixed version for your release line: 7.17.13 or 8.9.0.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-31418 being exploited?
There is no known exploitation of CVE-2023-31418 in the wild and no public exploit code.
Other vulnerabilities in Elastic Elasticsearch
- CVE-2025-37729 Elastic Cloud Enterprise (ECE) Improper Neutralization of Special Elements Used in a Template Engine
- CVE-2025-37736 Elastic Cloud Enterprise Improper Authorization
- CVE-2024-37282 Privilege escalation in Elastic Cloud Enterprise
- CVE-2018-3828 Information disclosure in Elastic Cloud Enterprise
- CVE-2022-23715 Information disclosure in Elastic Cloud Enterprise
Sources
Also known as BIT-elasticsearch-2023-31418, GHSA-2cqf-6xv9-f22w, MINI-q2jh-m7m4-mrhv, MINI-xppf-22vr-29w4, UBUNTU-CVE-2023-31418.