OpenSearch Dashboards contains an improper input validation vulnerability (CWE-1284) in its capabilities route handler that fails to bound the size of incoming request payloads. This allows remote attackers to send oversized HTTP requests that can cause denial of service by exhausting resources. The vulnerability affects all open-source self-managed OpenSearch Dashboards versions from 1.3.0 through 3.7.0 inclusive, including all 2.x releases up to 2.19.6. It is also present in Kibana versions 7.7.1 through 7.10.2. AWS OpenSearch Service engine versions including 1.3, 2.11, 2.13, 2.15, 2.17, 2.19, 3.1, 3.3, and 3.5, as well as Elasticsearch-compatible versions using Kibana 7.9 and 7.10, are affected. Fixed versions are available starting with OpenSearch Dashboards 3.8.0 and via patched service software updates for AWS-managed domains.

The vulnerability allows remote attackers to cause a denial of service by sending crafted HTTP requests with unbounded payload sizes to the capabilities route handler in OpenSearch Dashboards. This can disrupt availability of the affected service. There is no impact on confidentiality or integrity reported. The CVSS v3.1 base score is 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impact limited to availability.

For self-managed OpenSearch Dashboards, upgrade to version 3.8.0 or later to remediate the vulnerability. For Amazon OpenSearch Service customers, apply the latest available service software update to your domain as AWS has released patched service software addressing this issue. AWS manages remediation for their cloud-hosted service, so ensure your domain is updated promptly. There are no vendor advisories indicating that no action is required or that the issue is already mitigated without updates.