GHSA-8wx3-324g-w4qq: 
Java vulnerability analysis and mitigation

A high-severity vulnerability was identified in OpenSearch affecting versions <1.3.14.0 and <2.11.0.0, discovered by Elastic Engineering. The vulnerability, corresponding to security advisory ESA-2023-13 (CVE-2023-31418), was published on October 16, 2023. The issue affects the OpenSearch security plugin (org.opensearch.plugin:opensearch-security) and OpenSearch Docker images (GitHub Advisory).

The vulnerability relates to how OpenSearch handles incoming requests on the HTTP layer, with a CVSS v3.1 score of 7.5 (High). The technical assessment shows the vulnerability has a Network attack vector, Low attack complexity, requires No privileges, needs No user interaction, has Unchanged scope, with No impact on Confidentiality and Integrity, but High impact on Availability. The CVSS string is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (GitHub Advisory).

The vulnerability allows an unauthenticated user to force an OpenSearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests, potentially causing service disruption (GitHub Advisory).

The vulnerability has been patched in OpenSearch versions 1.3.14.0 and 2.11.0. Users are advised to upgrade to these patched versions to mitigate the vulnerability (GitHub Advisory).