org.elasticsearch.plugin:x-pack-security
Maven2 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting org.elasticsearch.plugin:x-pack-securitypage 1 of 1
- CVE-2025-37731HIGHCVSS 7.4EG 7.4fixed in 8.19.8, 9.1.8 or 9.2.2, by version range2025-12-15
vulnerable: 9.2.0, 9.2.1
Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate…
- CVE-2025-68384MEDIUMCVSS 6.5EG 6.5fixed in 8.19.9, 9.1.9 or 9.2.3, by version range2025-12-18
vulnerable: 9.2.0, 9.2.1, 9.2.2
Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a persistent denial of service (OOM crash) via submission of ov…
Check whether org.elasticsearch.plugin:x-pack-security is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for org.elasticsearch.plugin:x-pack-security CVEs against the assets you own.
Book a Demo →