CVE-2023-31419

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
Elastic	Elasticsearch	>= 7.0.0, < 7.17.12; >= 8.0.0, < 8.9.0

References

https://discuss.elastic.co/t/elasticsearch-8-9-1-7-17-13-security-update/343297Vendor Advisory
https://security.netapp.com/advisory/ntap-20231116-0010/Third Party Advisory
https://www.elastic.co/community/securityVendor Advisory
https://discuss.elastic.co/t/elasticsearch-8-9-1-7-17-13-security-update/343297Vendor Advisory
https://security.netapp.com/advisory/ntap-20231116-0010/Third Party Advisory
https://www.elastic.co/community/securityVendor Advisory

Timeline

Published: Oct 26, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-31425.4Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0.CVE-2023-314217.5It was discovered that when acting as TLS clients, Beats, Elastic Agent, APM Server, and Fleet Server did not verify whether the server cert CVE-2023-314227.5An issue was discovered by Elastic whereby sensitive information is recorded in Kibana logs in the event of an error. The issue impacts only CVE-2023-314235.5Possible information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking CVE-2023-314249.8Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and CVE-2023-314257.8A vulnerability in the fosexec command of Brocade Fabric OS after Brocade Fabric OS v9.1.0 and, before Brocade Fabric OS v9.1.1 could allow CVE-2023-314266.5The Brocade Fabric OS Commands “configupload” and “configdownload” before Brocade Fabric OS v9.1.1c, v8.2.3d, v9.2.0 print scp, sftp, ftp se CVE-2023-314277.8Brocade Fabric OS versions before Brocade Fabric OS v9.1.1c, and v9.2.0 Could allow an authenticated, local user with knowledge of full path CVE-2023-314285.5Brocade Fabric OS before Brocade Fabric OS v9.1.1c, v9.2.0 contains a vulnerability in the command line that could allow a local user to dum CVE-2023-314295.5Brocade Fabric OS before Brocade Fabric OS 9.1.1c, 9.2.0 contains a vulnerability when using various commands such as “chassisdistribute”, “CVE-2023-31435.4A vulnerability classified as problematic has been found in SourceCodester Online Discussion Forum Site 1.0. Affected is an unknown function CVE-2023-314305.5A buffer overflow vulnerability in “secpolicydelete” command in Brocade Fabric OS before Brocade Fabric OS v9.1.1c and v9.2.0 could allow an