CVE-2023-31418 - CVE House
Back to Database
Status published High CVE-2023-31418

Elasticsearch uncontrolled resource consumption

Vulnerability Description

An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering and we have no indication that the issue is known or that it is being exploited in the wild.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-31418

Credits & Attribution

No credits recorded in the NVD database.

References

More from Elastic

View All →
CVE-2025-68422
Kibana Improper Authorization
Medium 4.3
CVE-2025-68390
Elasticsearch Allocation of Resources Without Limits or Throttling
Medium 4.9
CVE-2025-68389
Kibana Allocation of Resources Without Limits or Throttling
Medium 6.5
CVE-2025-68388
Allocation of resources without limits or throttling (CWE-770) allows an...
Medium 5.3
CVE-2025-68387
Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Medium 6.1

Affected Vendor

Affected Software

Elasticsearch
Vulnerable Versions:
7.17.12, 8.0.0, 2.13.3

Timeline

Official Publish: October 26th, 2023
Last Modified: February 13th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact