This vulnerability (CVE-2026-75897) affects OpenSearch Dashboards version 1.3 and is classified under CWE-1284 (Improper Validation of Specified Quantity in Input). The issue arises because the capabilities route handler does not properly limit the size of the request payload, potentially enabling remote attackers to trigger a denial of service condition by sending specially crafted HTTP requests that exploit this lack of input size validation. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

The vulnerability can be exploited remotely without authentication or user interaction to cause a denial of service, impacting the availability of OpenSearch Dashboards 1.3. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://aws.amazon.com/security/security-bulletins/2026-082-aws/ for current remediation guidance. Until an official fix is available, consider limiting exposure of the affected service to untrusted networks and monitoring for unusual request sizes targeting the capabilities route handler.