org.elasticsearch.plugin:x-pack-core
Maven2 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting org.elasticsearch.plugin:x-pack-corepage 1 of 1
- CVE-2025-37731HIGHCVSS 7.4EG 7.4fixed in 8.19.8, 9.1.8 or 9.2.2, by version range2025-12-15
vulnerable: 9.2.0, 9.2.1
Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate…
- CVE-2025-68390MEDIUMCVSS 4.9EG 4.9fixed in 8.19.8, 9.1.8 or 9.2.2, by version range2025-12-18
vulnerable: 9.2.0, 9.2.1
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPEC-130) of memory and a denial of service (DoS) via crafted …
Check whether org.elasticsearch.plugin:x-pack-core is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for org.elasticsearch.plugin:x-pack-core CVEs against the assets you own.
Book a Demo →