CVE-2025-9624

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-9624
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-9624.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-9624
Aliases
Downstream
CGA (83)
MINI (2)
UBUNTU (1)
Published
2025-11-25T19:43:40Z
Modified
2026-10-22T02:47:54Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H CVSS Calculator
Summary
OpenSearch 3.2.0 - Nested Boolean/Disjunction asymmetric DoS
Details

A vulnerability in OpenSearch allows attackers to cause Denial of Service (DoS) by submitting complex query_string inputs.

This issue affects all OpenSearch versions between 3.0.0 and < 3.3.0 and OpenSearch < 2.19.4.

Database specific 
{
    "cna_assigner":  "Fluid Attacks",
    "cwe_ids":  [
        "CWE-674"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/9xxx/CVE-2025-9624.json"
}
References

Affected packages

Git / github.com/opensearch-project/opensearch

Affected ranges

Type
GIT
Repo
https://github.com/opensearch-project/opensearch
Events
Introduced
dc4efa821904cc2d7ea7ef61c0f577d3fc0d8be9
Fixed
e972d15408320e6be84c64bb0fdc076ca7696ea2
Introduced
34550c5b17124ddc59458ef774f6b43a086522e3
Fixed
e2e89961c9a327daf514a7ce1320a6189bfd08cd
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "3.0.0"
                },
                {
                    "fixed":  "3.3.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "introduced":  "1.0.0"
                },
                {
                    "fixed":  "2.19.4"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "original_tag":  "3.3.0",
            "range":  [
                {
                    "fixed":  "e972d15408320e6be84c64bb0fdc076ca7696ea2"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "2.19.4",
            "range":  [
                {
                    "fixed":  "e2e89961c9a327daf514a7ce1320a6189bfd08cd"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-9624.json"