Threats affecting pkg:maven/org.elasticsearch/elasticsearch

42 threats

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	6.5	EPSS 0.3%	CVE-2025-68384Elastic Elasticsearch · Unthrottled Resource Allocation Medium6.5EPSS 0.3%2025-12-18CVE Database V5CVE-2025-68384 Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of oversized user settings data. EPSS 0.3%Vulnerability CWE-770	CVE Database V5	2025-12-18
Medium	6.8	EPSS 0.2%	CVE-2025-37731Elastic Elasticsearch · Improper Authentication Medium6.8EPSS 0.2%2025-12-15CVE Database V5CVE-2025-37731 Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority. EPSS 0.2%Vulnerability CWE-287	CVE Database V5	2025-12-15

Page 3 of 3