CVE-2023-31418

An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering and we have no indication that the issue is known or that it is being exploited in the wild.

• CWE-400
• CWE-400

• https://discuss.elastic.co/t/elasticsearch-8-9-0-7-17-13-security-update/343616Vendor Advisory
• https://security.netapp.com/advisory/ntap-20231130-0005/
• https://www.elastic.co/community/securityVendor Advisory
• https://discuss.elastic.co/t/elasticsearch-8-9-0-7-17-13-security-update/343616Vendor Advisory
• https://security.netapp.com/advisory/ntap-20231130-0005/
• https://www.elastic.co/community/securityVendor Advisory

Published

Oct 26, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-31412The LMS5xx uses weak hash generation methods, resulting in t…7.5
• CVE-2023-31413Filebeat versions through 7.17.9 and 8.6.2 have a flaw in ht…3.3
• CVE-2023-31414Kibana versions 8.0.0 through 8.7.0 contain an arbitrary cod…8.8
• CVE-2023-31415Kibana version 8.7.0 contains an arbitrary code execution fl…8.8
• CVE-2023-31416Secret token configuration is never applied when using ECK <…5.3
• CVE-2023-31417Elasticsearch generally filters out sensitive information an…4.4
• CVE-2023-31419A flaw was discovered in Elasticsearch, affecting the _searc…7.5
• CVE-2023-3142Cross-site Scripting (XSS) - Stored in GitHub repository mic…5.4
• CVE-2023-31421It was discovered that when acting as TLS clients, Beats, El…7.5
• CVE-2023-31422An issue was discovered by Elastic whereby sensitive informa…7.5
• CVE-2023-31423Possible information exposure through log file vulnerabilit…5.5
• CVE-2023-31424Brocade SANnav Web interface before Brocade SANnav v2.3.0 an…9.8