CVE-2025-9624: 
Java vulnerability analysis and mitigation

CVE-2025-9624 is a Denial of Service (DoS) vulnerability in OpenSearch caused by uncontrolled recursion when processing complex query_string inputs. Discovered and disclosed on November 25, 2025, it was reported by researchers RafSobol and caverav (via Fluid Attacks). The vulnerability affects all OpenSearch versions below 2.19.4 and versions 3.0.0 through 3.2.x (fixed in 3.3.0). It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.3 (High) (GitHub Advisory).

The root cause is CWE-674 (Uncontrolled Recursion): OpenSearch's query_string query parser does not impose adequate limits on recursion depth or query complexity during query processing. An attacker can craft a deeply nested or highly complex query_string input that triggers excessive recursive processing, consuming CPU and memory resources until the service becomes unresponsive. The vulnerability requires low privileges (authenticated access) under CVSS v4.0 scoring, though the v3.1 score reflects no authentication requirement, suggesting the exploitability threshold may vary by deployment configuration. A proof-of-concept advisory is publicly available from Fluid Attacks (GitHub Advisory, Fluid Attacks Advisory). The fix introduced a new cluster setting search.query.max_query_string_length (PR #19491) to cap query string length and limit recursion (OpenSearch 2.19.4 Release, OpenSearch 3.3.0 Release).

Successful exploitation causes a Denial of Service, rendering the OpenSearch cluster unavailable for search and indexing operations. The availability impact is rated High for both the vulnerable system and subsequent systems (e.g., applications depending on OpenSearch), while confidentiality and integrity are unaffected. In environments where OpenSearch underpins critical search infrastructure — such as IBM Instana Observability or Cloudera Data Platform — service disruption could cascade to broader platform unavailability and performance degradation (GitHub Advisory, IBM Advisory).

A proof-of-concept exploit is publicly available via Fluid Attacks (Fluid Attacks Advisory), but there is no evidence of active in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.042% (2nd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (GitHub Advisory).

1. Reconnaissance: Identify exposed OpenSearch instances (versions < 2.19.4 or 3.0.0–3.2.x) using network scanning tools such as Shodan or Censys, or by querying the OpenSearch version endpoint (GET /).
2. Obtain access credentials: Acquire low-privileged credentials if authentication is enforced, or attempt unauthenticated access if the instance is misconfigured to allow it.
3. Craft a malicious query: Construct a deeply nested or highly complex query_string payload designed to trigger excessive recursion in the query parser. For example, a query with deeply nested boolean clauses or extremely long, complex expressions.
4. Submit the query: Send the crafted query via an HTTP POST request to the OpenSearch search endpoint (e.g., POST /<index>/_search) with the malicious query_string in the request body.
5. Trigger DoS: The recursive query processing exhausts CPU and/or memory resources on the OpenSearch node(s), causing service degradation or complete unavailability (Fluid Attacks Advisory, GitHub Advisory).

• Network: Unusual volume of HTTP POST requests to /<index>/_search or /_search endpoints containing abnormally large or deeply nested query_string parameters; requests originating from unexpected source IPs.
• Logs: OpenSearch logs showing repeated stack overflow errors, excessive GC activity, or out-of-memory warnings correlated with search requests; log entries referencing query parsing failures or recursion-related exceptions in opensearch.log.
• Process/System: Sudden spike in CPU or JVM heap usage on OpenSearch nodes coinciding with search request activity; JVM thread dumps showing deep recursion stacks in query parsing code paths.
• Application: Search API returning 503 or 429 errors; cluster health transitioning to red or yellow status unexpectedly.

Upgrade OpenSearch to version 2.19.4 (for the 2.x branch) or 3.3.0 (for the 3.x branch), which introduce the new cluster setting search.query.max_query_string_length to limit query string length and prevent uncontrolled recursion (OpenSearch 2.19.4 Release, OpenSearch 3.3.0 Release). As interim workarounds: configure network segmentation to restrict access to OpenSearch endpoints to trusted clients only; implement a reverse proxy or API gateway with request body size limits and query complexity controls; and monitor cluster resource usage to detect and block anomalous query patterns. IBM has also released patches for affected products including Instana Observability and Cloudera Data Platform (IBM Advisory).

The vulnerability was discovered and reported by researchers RafSobol and caverav through Fluid Attacks, who published a dedicated advisory (Fluid Attacks Advisory). Community discussion appeared on the OpenSearch forum shortly after disclosure (OpenSearch Forum). The OpenSearch project addressed the issue in the 3.3.0 release blog (OpenSearch Blog). No significant broader media coverage or notable threat actor commentary has been observed.