What is GHSA-gphj-4h6p-37xq?

GHSA-gphj-4h6p-37xq is a security advisory published by GitHub Security Advisories with Medium severity. Elasticsearch privileged authenticated users can cause DoS through Excessive Resource Allocation

Which CVE IDs does GHSA-gphj-4h6p-37xq cover?

GHSA-gphj-4h6p-37xq covers the following CVE IDs: CVE-2025-68390. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-gphj-4h6p-37xq?

GHSA-gphj-4h6p-37xq has a CVSS v3 base score of 4.9, published by GitHub Security Advisories.

Which products are affected by GHSA-gphj-4h6p-37xq?

GHSA-gphj-4h6p-37xq affects 3 products, including: maven/org.elasticsearch.plugin:x-pack-core:\u003c 8.19.8; maven/org.elasticsearch.plugin:x-pack-core:\u003e= 9.0.0, \u003c 9.1.8; maven/org.elasticsearch.plugin:x-pack-core:\u003e= 9.2.0, \u003c 9.2.2.

GHSA-gphj-4h6p-37xqMediumCVSS 4.9

Elasticsearch privileged authenticated users can cause DoS through Excessive Resource Allocation

Vendor

GitHub Security Advisories

Published

December 19, 2025

Last Modified

December 19, 2025

🔗 CVE IDs covered (1)

CVE-2025-68390 →

📋 Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory and a denial of service (DoS) via crafted HTTP request.

🎯 Affected products3

maven/org.elasticsearch.plugin:x-pack-core:< 8.19.8
maven/org.elasticsearch.plugin:x-pack-core:>= 9.0.0, < 9.1.8
maven/org.elasticsearch.plugin:x-pack-core:>= 9.2.0, < 9.2.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-68390
https://discuss.elastic.co/t/elasticsearch-8-19-8-9-1-8-and-9-2-2-security-update-esa-2025-37/384185
https://github.com/elastic/elasticsearch/pull/138132
https://github.com/advisories/GHSA-gphj-4h6p-37xq