VYPR
← All advisories
High severityNVD Advisory· Published Oct 26, 2023· Updated Feb 13, 2025

Elasticsearch uncontrolled resource consumption

CVE-2023-31418

Description

An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering and we have no indication that the issue is known or that it is being exploited in the wild.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Elasticsearch is vulnerable to uncontrolled resource consumption via malformed HTTP requests, allowing an unauthenticated attacker to cause an OutOfMemory error, mitigated in versions 7.17.13 and 8.9.0.

Vulnerability

Description CVE-2023-31418 is a vulnerability in Elasticsearch where the HTTP layer improperly handles malformed requests, leading to uncontrolled memory consumption. An unauthenticated attacker can send a moderate number of specially crafted HTTP requests to an Elasticsearch node, causing the node to exhaust its memory and exit with an OutOfMemory error [1][3].

Attack

Vector The attack is remotely exploitable over the network without authentication or user interaction (CVSS: 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The attacker only needs the ability to send HTTP requests to the vulnerable Elasticsearch node [1].

Impact

Successful exploitation results in a denial of service by crashing the Elasticsearch node, potentially affecting the entire cluster's availability. The vulnerability does not affect confidentiality or integrity [1][3].

Mitigation

Elastic has released patches: upgrade to Elasticsearch 7.17.13, 8.9.0, or later. For Elastic Cloud Enterprise, upgrade to versions 2.13.4 or 3.6.1. No workarounds are available [3]. There is no evidence of active exploitation [1].

References
  1. NVD - CVE-2023-31418
  2. Elasticsearch 8.9.0, 7.17.13 Security Update

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.elasticsearch:elasticsearchMaven
< 7.17.137.17.13
org.elasticsearch:elasticsearchMaven
>= 8.0.0, < 8.9.08.9.0

Affected products

137

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.