Hello @speechkey - I spoke with @davelago (SDM, OpenSeach) and he confirmed: Thank you for your message about the CVEs reported in OpenSearch versions 1 and 2. After a thorough review we have determined these versions are not impacted by CVE-2022-42889.