# Elasticsearch 8.9.1 / 7.17.13 Security Update

**URL:** <https://discuss.elastic.co/t/elasticsearch-8-9-1-7-17-13-security-update/343297>\
**Category:** Security Announcements\
**Created:** [September 18, 2023, 8:40pm UTC](https://discuss.elastic.co/t/elasticsearch-8-9-1-7-17-13-security-update/343297 "2023-09-18T20:40:51Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![rodrigo\_silva](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rodrigo_silva/32/120546_2.png) [@rodrigo\_silva](https://discuss.elastic.co/u/rodrigo_silva)\
**Post date:** [September 18, 2023, 8:40pm UTC](https://discuss.elastic.co/t/elasticsearch-8-9-1-7-17-13-security-update/343297/1 "2023-09-18T20:40:51Z")

</div>

# Elasticsearch StackOverflow vulnerability (ESA-2023-14)

A flaw was discovered in Elasticsearch, affecting the `_search` API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.

## Affected Versions:

Elasticsearch versions from 7.0.0 to 7.17.12 and from 8.0.0 to 8.9.0

## Solutions and Mitigations:

The issue is resolved in Elasticsearch 7.17.13 and 8.9.1

**CVSSv3:** 6.5 (Medium) - AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H  
**CVE ID:** CVE-2023-31419