Denial of Service Vulnerability in OpenSearch by Amazon Web Services
CVE-2025-9624

8.3HIGH

Key Information:

Vendor

Opensearch

Status
Opensearch
Vendor
CVE Published:
25 November 2025

What is CVE-2025-9624?

A security vulnerability in OpenSearch enables malicious actors to execute Denial of Service attacks by manipulating complex query_string inputs. This flaw poses a significant risk to the integrity and availability of services utilizing OpenSearch, especially in versions prior to 3.2.0. Organizations using affected versions should prioritize updating to mitigate potential disruptions.

Affected Version(s)

OpenSearch Windows 3.0.0 < 3.3.0

OpenSearch Windows 1.0.0 < 2.19.4

References

https://fluidattacks.com/advisories/chick
third-party-advisory
https://github.com/opensearch-project/OpenSearch/releases...
patchrelease-notes
https://github.com/opensearch-project/OpenSearch/releases...
patchrelease-notes

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Camilo Vera
.