Medium severity4.2NVD Advisory· Published Sep 17, 2025· Updated Jun 17, 2026
CVE-2025-35434
CVE-2025-35434
Description
CISA Thorium does not validate TLS certificates when connecting to Elasticsearch. An unauthenticated attacker with access to a Thorium cluster could impersonate the Elasticsearch service. Fixed in 1.1.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
4- raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-259-01.jsonnvdVendor Advisory
- www.cve.org/CVERecordnvdThird Party Advisory
- github.com/cisagov/thorium/blob/main/api/src/models/backends/setup/elastic_setup.rsnvdProduct
- github.com/cisagov/thorium/releases/tag/1.1.2nvdRelease Notes
News mentions
0No linked articles in our index yet.