Listen to this Post
How the CVE works: The vulnerability resides in the OpenSearch query_string parser. Attackers can submit complex query_string inputs containing deeply nested boolean operators, wildcards, or regular expressions. These malicious inputs cause the parser to generate an excessively large abstract syntax tree (AST). Processing this AST requires disproportionate computational resources, leading to high CPU and memory consumption. The parser’s lack of complexity limits allows these inefficient queries to execute. This resource exhaustion triggers a denial of service, rendering the OpenSearch cluster unresponsive. The flaw is remotely exploitable without authentication if the search endpoint is accessible. All OpenSearch versions prior to 3.2.0 contain this unpatched query processing logic. Repeated submission of such crafted queries can cripple cluster performance and availability.
Platform: OpenSearch
Version: Below 3.2.0
Vulnerability: Denial of Service
Severity: Critical
Date: 2025-11-25
Prediction: Patch 2025-12-02
What Undercode Say:
Analytics:
curl -X POST "http://localhost:9200/index/_search" -H 'Content-Type: application/json' -d '{"query":{"query_string":{"query":" AND (a OR b) AND (c OR d)~5"}}}'
import requests
import sys
target = sys.argv[bash]
payload = {'query': {'query_string': {'query': 'a AND (b OR c) AND (d OR e)'}}}
response = requests.post(f'{target}/_search', json=payload)
print(response.status_code)
How Exploit:
Craft complex query_string with nested operators. Send repeated HTTP requests. Exploit resource exhaustion.
Protection from this CVE
Upgrade to version 3.2.0. Implement query complexity limits. Use network access controls.
Impact:
Service unavailability. Resource exhaustion. Cluster performance degradation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
