-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability allows for a Denial of Service by sending a complex query_string to OpenSearch. The provided patch, found in pull request #19491, introduces a mitigation by adding a length check to the query string. The analysis of the commits associated with this pull request points directly to the org.opensearch.index.search.QueryStringQueryParser.parse method. In commit f63df79004f3ac0d49078466af71df8e19e16787, a check is added to this method to ensure the query string length does not exceed a new configurable setting, search.query.max_query_string_length. Before this change, the method would pass the raw, unchecked query string to the underlying XQueryParser, which would then trigger the DoS condition when processing a very long and complex input. Therefore, the parse method is the entry point for the malicious input and is the function that would appear in a runtime profile during exploitation.
org.opensearch.index.search.QueryStringQueryParser.parseserver/src/main/java/org/opensearch/index/search/QueryStringQueryParser.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.opensearch:opensearch-common | maven | < 3.3.0 | 3.3.0 |
A Semantic Attack on Google Gemini - Read the Latest Research