# \#cve **URL:** https://forum.opensearch.org/tag/cve/30.md [Latest](https://forum.opensearch.org/latest.md) · [Categories](https://forum.opensearch.org/categories.md) · [Tags](https://forum.opensearch.org/tags.md) --- ## [Opensearch Bouncy Castle Provider - FIPS 2.1.3 Vulnerabilities](https://forum.opensearch.org/t/opensearch-bouncy-castle-provider-fips-2-1-3-vulnerabilities/28309)
**Author:** [@mohan-rh7](https://forum.opensearch.org/u/mohan-rh7)\ **Replies:** 1\ **Last updated:** [October 2, 2026, 11:57am UTC](https://forum.opensearch.org/t/opensearch-bouncy-castle-provider-fips-2-1-3-vulnerabilities/28309 "2026-10-02T11:57:04Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Opensearch 3.9.0 Describe the issue: The following High vulnerabilies are still present in Bouncy Castle Provider - FIPS 2.1.3 in Opensearch 3.9.0. CVE-2026… --- ## [Log4j 2.25.4 Vulnerability in OpenSearch 3.8.0](https://forum.opensearch.org/t/log4j-2-25-4-vulnerability-in-opensearch-3-8-0/28266)
**Author:** [@scott](https://forum.opensearch.org/u/scott)\ **Replies:** 1\ **Last updated:** [September 3, 2026, 5:23pm UTC](https://forum.opensearch.org/t/log4j-2-25-4-vulnerability-in-opensearch-3-8-0/28266 "2026-09-03T17:23:06Z")
Versions: OpenSearch 3.8.0 & Log4j 2.25.4 Describe the issue: OpenSearch 3.8.0 uses Log4j 2.25.4 which has a vulnerability, CVE-2026-49844. Does CVE-2026-49844 impact OpenSearch? Any plans to upgrade Log4j version? … --- ## [OpenSearch 3.6.0 still flagged for Log4j vulnerability CVE-2026-34478](https://forum.opensearch.org/t/opensearch-3-6-0-still-flagged-for-log4j-vulnerability-cve-2026-34478/28104)
**Author:** [@mohit24](https://forum.opensearch.org/u/mohit24)\ **Replies:** 1\ **Last updated:** [June 2, 2026, 7:49pm UTC](https://forum.opensearch.org/t/opensearch-3-6-0-still-flagged-for-log4j-vulnerability-cve-2026-34478/28104 "2026-06-02T19:49:58Z")
We upgraded our OpenSearch cluster to version 3.6.0; however, our vulnerability scanning tool (Nessus) continues to report a Log4j vulnerability related to CVE-2026-34478. Vulnerability Details Vulnerability: CVE-202… --- ## [Opensearch Netty vulnerability](https://forum.opensearch.org/t/opensearch-netty-vulnerability/28101)
**Author:** [@nikhil.rathore](https://forum.opensearch.org/u/nikhil.rathore)\ **Replies:** 1\ **Last updated:** [June 2, 2026, 7:37pm UTC](https://forum.opensearch.org/t/opensearch-netty-vulnerability/28101 "2026-06-02T19:37:02Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 3.6.0 Describe the issue: Latest opensearch 3.6.0 has critical vulneability on Netty Project 4.2.12.Final and Netty Project 4.2.7.Final. Below are the vulner… --- ## [Security Advisory: Compromised npm Development Packages](https://forum.opensearch.org/t/security-advisory-compromised-npm-development-packages/28060)
**Author:** [@kris](https://forum.opensearch.org/u/kris)\ **Replies:** 2\ **Last updated:** [June 2, 2026, 2:15pm UTC](https://forum.opensearch.org/t/security-advisory-compromised-npm-development-packages/28060 "2026-06-02T14:15:56Z")
UPDATE: 15-May-2026 Resolved. GitHub organization is unlocked, CI/CD pipelines & GitHub Actions secrets have been rotated, and repositories are back online. Thank you for your patience. =============================== … --- ## [Axios CVE-2026-40175: backport plan and version compatibility for 3.x users](https://forum.opensearch.org/t/axios-cve-2026-40175-backport-plan-and-version-compatibility-for-3-x-users/28017)
**Author:** [@mintak](https://forum.opensearch.org/u/mintak)\ **Replies:** 0\ **Last updated:** [April 22, 2026, 11:24pm UTC](https://forum.opensearch.org/t/axios-cve-2026-40175-backport-plan-and-version-compatibility-for-3-x-users/28017 "2026-04-22T23:24:05Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch: 3.2.0 OpenSearch Dashboards: 3.2.0 (tarball installation) OS: Ubuntu 24.04 Browser: N/A (question is about server-side dependency) Describe the… --- ## [CVE-2026-33870/1 High Vulnerabilities in netty](https://forum.opensearch.org/t/cve-2026-33870-1-high-vulnerabilities-in-netty/27991)
**Author:** [@NeilBillett](https://forum.opensearch.org/u/NeilBillett)\ **Replies:** 4\ **Last updated:** [April 21, 2026, 12:13pm UTC](https://forum.opensearch.org/t/cve-2026-33870-1-high-vulnerabilities-in-netty/27991 "2026-04-21T12:13:35Z")
Hi - are there any plans/mitigations for these two recent high severity vulnerabilities for netty: They are vulnerabilities in \< netty 4.1.132.Final around DoS and request smuggling. I see in the recent 2.19.5 rele… --- ## [CVE-2025-9624 Doubts](https://forum.opensearch.org/t/cve-2025-9624-doubts/27578)
**Author:** [@shadowfax](https://forum.opensearch.org/u/shadowfax)\ **Replies:** 1\ **Last updated:** [December 4, 2025, 9:44am UTC](https://forum.opensearch.org/t/cve-2025-9624-doubts/27578 "2025-12-04T09:44:04Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Opensearch: 2.19.3 Describe the issue: We are facing CV CVE-2025-9624 and we are using Graylog with Opensearch: 2.19.3. What should be done to resolve the i… --- ## [Multiple CVEs affecting opensearch-dashboards](https://forum.opensearch.org/t/multiple-cves-affecting-opensearch-dashboards/24115)
**Author:** [@bt-aengdahl](https://forum.opensearch.org/u/bt-aengdahl)\ **Replies:** 2\ **Last updated:** [April 17, 2025, 1:58pm UTC](https://forum.opensearch.org/t/multiple-cves-affecting-opensearch-dashboards/24115 "2025-04-17T13:58:21Z")
opensearch-dashboards v2.19.1 has been flagged by my organization for bundling a vulnerable version of the node.js binary. The version of Node.js installed on the remote host is prior to 18.20.6, 20.18.2, 22.13.1, 23.6… --- ## [CVE-2025-24970 Apache Netty \< 4.1.118.Final](https://forum.opensearch.org/t/cve-2025-24970-apache-netty-4-1-118-final/23580)
**Author:** [@NeilBillett](https://forum.opensearch.org/u/NeilBillett)\ **Replies:** 6\ **Last updated:** [February 28, 2025, 4:55pm UTC](https://forum.opensearch.org/t/cve-2025-24970-apache-netty-4-1-118-final/23580 "2025-02-28T16:55:20Z")
Hi, Are there any updates or mitigations available for https://nvd.nist.gov/vuln/detail/CVE-2025-24970 This is a recent high severity vulnerability in Apache Netty versions 4.1.91.Final through to 4.1.117.Final. If su… --- ## [Facing Vulnerability and compliance issue on opensearch:2.16.0 and opensearch-dashboards:2.16.0](https://forum.opensearch.org/t/facing-vulnerability-and-compliance-issue-on-opensearch-2-16-0-and-opensearch-dashboards-2-16-0/21676)
**Author:** [@RupeshPawarBH](https://forum.opensearch.org/u/RupeshPawarBH)\ **Replies:** 0\ **Last updated:** [September 27, 2024, 11:03am UTC](https://forum.opensearch.org/t/facing-vulnerability-and-compliance-issue-on-opensearch-2-16-0-and-opensearch-dashboards-2-16-0/21676 "2024-09-27T11:03:10Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): opensearch:2.16.0 and opensearch-dashboards:2.16.0 Describe the issue: In lates version of opensearch:2.16.0 & opensearch-dashboard:2.16.0 we found complia… --- ## [CVE-2024-28752 vulnerability in opensearch](https://forum.opensearch.org/t/cve-2024-28752-vulnerability-in-opensearch/21481)
**Author:** [@Bhupendra](https://forum.opensearch.org/u/Bhupendra)\ **Replies:** 2\ **Last updated:** [September 19, 2024, 5:10am UTC](https://forum.opensearch.org/t/cve-2024-28752-vulnerability-in-opensearch/21481 "2024-09-19T05:10:38Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Opensearch 2.13.0 Describe the issue: A client of ours, reported vulnerability CVE-2024-28752 in opensearch-security/cxf-core-4.0.3.jar Configuration: Re… --- ## [Security vulnerability in open search v 2.15](https://forum.opensearch.org/t/security-vulnerability-in-open-search-v-2-15/20486)
**Author:** [@Rakesh1](https://forum.opensearch.org/u/Rakesh1)\ **Replies:** 4\ **Last updated:** [August 5, 2024, 8:05pm UTC](https://forum.opensearch.org/t/security-vulnerability-in-open-search-v-2-15/20486 "2024-08-05T20:05:22Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): opensearchproject/opensearch:2.15.0 Describe the issue: The PRISMA scan for the latest version of Open Search has resulted in issues. (1-high and 12 medium… --- ## [Having huge index without data?](https://forum.opensearch.org/t/having-huge-index-without-data/20278)
**Author:** [@hugne](https://forum.opensearch.org/u/hugne)\ **Replies:** 5\ **Last updated:** [July 28, 2024, 9:13pm UTC](https://forum.opensearch.org/t/having-huge-index-without-data/20278 "2024-07-28T21:13:57Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 2.8 build date 2023-06-03 Describe the issue: The size of the index is 50GB. The query reports to have 62642231 documents but I can’t see them in the Open… --- ## [Bundled nodejs - cve-2024-27982](https://forum.opensearch.org/t/bundled-nodejs-cve-2024-27982/20054)
**Author:** [@slarm](https://forum.opensearch.org/u/slarm)\ **Replies:** 0\ **Last updated:** [June 28, 2024, 12:48pm UTC](https://forum.opensearch.org/t/bundled-nodejs-cve-2024-27982/20054 "2024-06-28T12:48:28Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 2.14.0 - 2.15.0, nodejs 8.19.0 Describe the issue: Our security scans shows that the bundled nodejs is affected by cve-2024-27982 (Node.js — Wednesday, Apr… --- ## [Potential security issues with the bundled node.js](https://forum.opensearch.org/t/potential-security-issues-with-the-bundled-node-js/17365)
**Author:** [@chrisbra](https://forum.opensearch.org/u/chrisbra)\ **Replies:** 3\ **Last updated:** [May 5, 2024, 5:08pm UTC](https://forum.opensearch.org/t/potential-security-issues-with-the-bundled-node-js/17365 "2024-05-05T17:08:23Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 2.11.0 Describe the issue: I got a report, that the bundled node in opensearch dashboards (which seems to be 18.6.0 up to OSD v2.11.1 is vulnerable to the … --- ## [How to upgrade nodejs in OpenSearch Dashboards](https://forum.opensearch.org/t/how-to-upgrade-nodejs-in-opensearch-dashboards/19081)
**Author:** [@nap608](https://forum.opensearch.org/u/nap608)\ **Replies:** 0\ **Last updated:** [April 26, 2024, 10:16pm UTC](https://forum.opensearch.org/t/how-to-upgrade-nodejs-in-opensearch-dashboards/19081 "2024-04-26T22:16:50Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): OS - 2.4.0 Node.js - 14.20.0 Describe the issue: we’ve found a lot of CVE’s within the opensearch-dashboard node.js 14.20, and we would like to update … --- ## [Do we know if there are any known vulnerabilities in opensearch version 2.8.0?](https://forum.opensearch.org/t/do-we-know-if-there-are-any-known-vulnerabilities-in-opensearch-version-2-8-0/15068)
**Author:** [@knagarajan](https://forum.opensearch.org/u/knagarajan)\ **Replies:** 3\ **Last updated:** [July 13, 2023, 7:01pm UTC](https://forum.opensearch.org/t/do-we-know-if-there-are-any-known-vulnerabilities-in-opensearch-version-2-8-0/15068 "2023-07-13T19:01:02Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 2.8.0 Describe the issue: Our internal tool is detecting below vulnerabilities in opensearch/modules/systemd/systemd-2.8.0.jar. \[CVE-2017-1000082\] \[CVE-2… --- ## [I Geeting some vulnerability issue in opensearchproject/opensearch:2.8.0 docker Image](https://forum.opensearch.org/t/i-geeting-some-vulnerability-issue-in-opensearchproject-opensearch-2-8-0-docker-image/14732)
**Author:** [@bhanu1](https://forum.opensearch.org/u/bhanu1)\ **Replies:** 3\ **Last updated:** [June 29, 2023, 4:58pm UTC](https://forum.opensearch.org/t/i-geeting-some-vulnerability-issue-in-opensearchproject-opensearch-2-8-0-docker-image/14732 "2023-06-29T16:58:14Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): CVE-2023-24540 CVE-2023-24538 CVE-2023-23914 CVE-2022-37434 CVE-2022-32221 CVE-2022-32207 CVE-2022-23806 CVE-2022-1996 Describe the issue: Configura… --- ## [I Geeting some vulnerability issue in opensearchproject/opensearch-Dashboard:2.8.0 docker Image](https://forum.opensearch.org/t/i-geeting-some-vulnerability-issue-in-opensearchproject-opensearch-dashboard-2-8-0-docker-image/14734)
**Author:** [@bhanu1](https://forum.opensearch.org/u/bhanu1)\ **Replies:** 2\ **Last updated:** [June 22, 2023, 12:51pm UTC](https://forum.opensearch.org/t/i-geeting-some-vulnerability-issue-in-opensearchproject-opensearch-dashboard-2-8-0-docker-image/14734 "2023-06-22T12:51:29Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): CVE-2023-2650 Describe the issue: Configuration: Relevant Logs or Screenshots: --- ## [I Geeting some vulnerability issue in opensearchproject/opensearch:2.8.0 docker Image. Image,](https://forum.opensearch.org/t/i-geeting-some-vulnerability-issue-in-opensearchproject-opensearch-2-8-0-docker-image-image/14731)
**Author:** [@bhanu1](https://forum.opensearch.org/u/bhanu1)\ **Replies:** 0\ **Last updated:** [June 19, 2023, 10:45am UTC](https://forum.opensearch.org/t/i-geeting-some-vulnerability-issue-in-opensearchproject-opensearch-2-8-0-docker-image-image/14731 "2023-06-19T10:45:39Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): CVE-2023-24540 CVE-2023-24538 CVE-2023-23914 CVE-2022-37434 CVE-2022-32221 CVE-2022-32207 CVE-2022-23806 CVE-2022-1996 Describe the issue: Configura… --- ## [Facing issue with OpenSearch image vulnerabilities of OpenSearch Dashboard](https://forum.opensearch.org/t/facing-issue-with-opensearch-image-vulnerabilities-of-opensearch-dashboard/12918)
**Author:** [@bhanu1](https://forum.opensearch.org/u/bhanu1)\ **Replies:** 3\ **Last updated:** [April 18, 2023, 2:27pm UTC](https://forum.opensearch.org/t/facing-issue-with-opensearch-image-vulnerabilities-of-opensearch-dashboard/12918 "2023-04-18T14:27:55Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Hi Team, We are facing below OpenSearch image issues. Could you please check and fix the issues. CVE-2020-36604 Describe the issue: Configuration: Rele… --- ## [Do you want live notifications when people reply to your posts? Enable Notifications Facing issue with OpenSearch image vulnerabilities of OpenSearch Logstash](https://forum.opensearch.org/t/do-you-want-live-notifications-when-people-reply-to-your-posts-enable-notifications-facing-issue-with-opensearch-image-vulnerabilities-of-opensearch-logstash/12919)
**Author:** [@bhanu1](https://forum.opensearch.org/u/bhanu1)\ **Replies:** 1\ **Last updated:** [March 8, 2023, 7:45pm UTC](https://forum.opensearch.org/t/do-you-want-live-notifications-when-people-reply-to-your-posts-enable-notifications-facing-issue-with-opensearch-image-vulnerabilities-of-opensearch-logstash/12919 "2023-03-08T19:45:38Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Hi Team, We are facing below OpenSearch logstash image \[vulnerabilities\] issues. Could you please check and fix the issues. CVE-2022-1471 CVE-2022-42004 … --- ## [Facing issue with OpenSearch Logstash image Vulnerabilities](https://forum.opensearch.org/t/facing-issue-with-opensearch-logstash-image-vulnerabilities/12156)
**Author:** [@opensearch](https://forum.opensearch.org/u/opensearch)\ **Replies:** 2\ **Last updated:** [March 3, 2023, 12:27pm UTC](https://forum.opensearch.org/t/facing-issue-with-opensearch-logstash-image-vulnerabilities/12156 "2023-03-03T12:27:59Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Hi Team, we are facing the below logstash image vulnerability issues. Could you please take a look and help on the fix. CVE-2022-42004 CVE-2022-42003 C… --- ## [Could we get more info on the impact of CVE-2022-42920 in OpenSearch with a Critical 9.8 score?](https://forum.opensearch.org/t/could-we-get-more-info-on-the-impact-of-cve-2022-42920-in-opensearch-with-a-critical-9-8-score/11844)
**Author:** [@ericallen](https://forum.opensearch.org/u/ericallen)\ **Replies:** 1\ **Last updated:** [February 9, 2023, 8:55pm UTC](https://forum.opensearch.org/t/could-we-get-more-info-on-the-impact-of-cve-2022-42920-in-opensearch-with-a-critical-9-8-score/11844 "2023-02-09T20:55:51Z")
In the release notes for 2.4.1 and 1.3.7, there is reference to CVE-2022-42920 which has a CVE score of Critical 9.8 for bcel. This is very similar in score to the log4j fiasco last year. What impact does this vulnerab… --- ## [How to remove this opensearch-dashboard CVE-2020-36604 security vulnerability issue in 1.3.6](https://forum.opensearch.org/t/how-to-remove-this-opensearch-dashboard-cve-2020-36604-security-vulnerability-issue-in-1-3-6/12073)
**Author:** [@ranjeetsingh0902](https://forum.opensearch.org/u/ranjeetsingh0902)\ **Replies:** 3\ **Last updated:** [February 6, 2023, 1:26pm UTC](https://forum.opensearch.org/t/how-to-remove-this-opensearch-dashboard-cve-2020-36604-security-vulnerability-issue-in-1-3-6/12073 "2023-02-06T13:26:48Z")
We are facing this CVE-2020-36604 security vulnerability issue in 1.3.6. Some can help me how can i resolve this issue. opensearch-dashboard. Relevant Logs or Screenshots: --- ## [Facing issue with OpenSearch image vulnerabilities](https://forum.opensearch.org/t/facing-issue-with-opensearch-image-vulnerabilities/12157)
**Author:** [@opensearch](https://forum.opensearch.org/u/opensearch)\ **Replies:** 2\ **Last updated:** [January 26, 2023, 2:31pm UTC](https://forum.opensearch.org/t/facing-issue-with-opensearch-image-vulnerabilities/12157 "2023-01-26T14:31:11Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Hi Team, We are facing below OpenSearch image issues. Could you please check and fix the issues. |CVE-2022-46175| |CVE-2020-36604| |CVE-2017-20165| |CV… --- ## [Moment.js vulnerabilities question](https://forum.opensearch.org/t/moment-js-vulnerabilities-question/11858)
**Author:** [@md1eg0](https://forum.opensearch.org/u/md1eg0)\ **Replies:** 1\ **Last updated:** [December 20, 2022, 9:00pm UTC](https://forum.opensearch.org/t/moment-js-vulnerabilities-question/11858 "2022-12-20T21:00:25Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch Dashboards 1.2.0 Describe the issue: Recently, I noticed that OpenSearch Dashboards 1.2.0 uses the library moment.js version 2.28.0, which has the… --- ## [Opensearch - CVE-2022-42889 Apache Commons-Text RCE - opensearch-2.2.1](https://forum.opensearch.org/t/opensearch-cve-2022-42889-apache-commons-text-rce-opensearch-2-2-1/11477)
**Author:** [@Babu](https://forum.opensearch.org/u/Babu)\ **Replies:** 1\ **Last updated:** [November 14, 2022, 8:07am UTC](https://forum.opensearch.org/t/opensearch-cve-2022-42889-apache-commons-text-rce-opensearch-2-2-1/11477 "2022-11-14T08:07:28Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Describe the issue: Opensearch 2.2.1 has the commons-text version 1.9 which has a security issue. We need to have commons-text version 1.10 as minimum to f… --- ## [Text4Shell CVE (CVE-2022-42889) detected in OpenSearch](https://forum.opensearch.org/t/text4shell-cve-cve-2022-42889-detected-in-opensearch/11392)
**Author:** [@tpatil30](https://forum.opensearch.org/u/tpatil30)\ **Replies:** 1\ **Last updated:** [November 1, 2022, 10:43am UTC](https://forum.opensearch.org/t/text4shell-cve-cve-2022-42889-detected-in-opensearch/11392 "2022-11-01T10:43:52Z")
Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): Hi, I am using OpenSearch version 2.2.1 on docker container on a linux RHEL host. Describe the issue: Recently our security team identified ‘Apache Common… [Next page](https://forum.opensearch.org/tag/cve/30.md?match_all_tags=true&page=1&tags%5B%5D=cve)