CVE-2023-31419: Elasticsearch vulnerable to stack overflow in the search API

October 26, 2023 (updated October 30, 2023)

A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.

References

discuss.elastic.co/t/elasticsearch-8-9-1-7-17-13-security-update/343297
github.com/advisories/GHSA-qwrx-45xf-jjf7
nvd.nist.gov/vuln/detail/CVE-2023-31419
www.elastic.co/community/security

Code Behaviors & Features

Detect and mitigate CVE-2023-31419 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →