CVE-2025-9624 OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS

What is CVE-2025-9624?

CVE-2025-9624 is a high-severity denial of service vulnerability in OpenSearch, published on 25 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in OpenSearch allows attackers to cause Denial of Service (DoS) by submitting complex query_string inputs.

This issue affects all OpenSearch versions between 3.0.0 and < 3.3.0 and OpenSearch < 2.19.4.

Weakness: CWE-674

Which versions are affected by CVE-2025-9624?

4 open source packages ship an affected version, including org.opensearch:opensearch-common. It affects 1 product.

Products include Amazon Opensearch.

How do I fix CVE-2025-9624?

Upgrade org.opensearch:opensearch-common to a fixed version for your release line: 2.19.4 or 3.3.0.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-9624 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-9624 exists.

Other vulnerabilities in OpenSearch

• CVE-2022-31115 Unsafe YAML deserialization in opensearch-ruby High 8.8
• CVE-2022-35980 OpenSearch vulnerable to Improper Authorization of Index Containing Sensitive Information High 7.5
• CVE-2022-41918 Issue with fine-grained access control of indices backing data streams Medium 6.3
• CVE-2023-23933 Issue in Anomaly Detection with document and field level rules in numerical feature aggregations Medium 5.7
• CVE-2023-23613 Field-level security issue with .keyword fields in OpenSearch Medium 5.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mw3v-mmfw-3x2g, MINI-hw5q-jccc-cj85, MINI-m6mx-5c6p-xgfr, UBUNTU-CVE-2025-9624.