| Package | Affected versions | Patched versions |
|---|---|---|
| elasticsearch | ≥ 8.12.0, < 8.19.23≥ 9.0.0, ≤ 9.3.8≥ 9.4.0, < 9.4.8≥ 9.5.0, < 9.5.5 | 8.19.239.4.89.5.5 |
Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an excessively large `description` field are created and subsequently accessed, exhausting available heap memory and crashing the affected node.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free