Cyber Resilience

CVE-2023-31419

Medium

Published: 26 October 2023

Published
26 October 2023
Modified
13 February 2025
KEV Added
Patch
CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.3513 97.1th percentile
Risk Priority 34 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-31419 is a medium-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Elastic Elasticsearch. Its CVSS base score is 6.5 (Medium).

Operationally, ranked in the top 2.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

A flaw was discovered in Elasticsearch affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service. The issue is tracked under CVE-2023-31419 with a CVSS 3.1 score of 6.5 and is associated with CWE-121 and CWE-787.

An attacker with low privileges can send a malicious query over the network to trigger the stack overflow condition, resulting in a denial of service that affects availability while leaving confidentiality and integrity intact.

Elastic has released security updates in Elasticsearch versions 8.9.1 and 7.17.13 to address the vulnerability, as noted in their community security advisory and related NetApp notices recommending customers apply the patches.

The associated EPSS score reached a peak of 0.3921 with a current value of 0.3513.

EU & UK References

Vulnerability details

A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

elastic
elasticsearch
7.0.0 — 7.17.12 · 8.0.0 — 8.9.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-787

Out-of-bounds writes that corrupt control flow or inject shellcode are rendered non-executable by the same memory protections.

References