{"action":"Upgrade org.opensearch:opensearch-common to 2.19.4 (2.x) or 3.3.0 (3.x) or later.","affected":[{"fixed":"3.3.0","introduced":"3.0.0"},{"fixed":"2.19.4","introduced":"0"}],"component":"org.opensearch:opensearch-common","cve_ids":["CVE-2025-9624"],"ecosystem":"Maven","epss":0.00727,"exploited":false,"fixed_versions":["3.3.0","2.19.4"],"ghsa_id":"GHSA-mw3v-mmfw-3x2g","id":"tcs_01M5N95WXWJ81QP8QT3RHRWZYM","modified_at":"2026-09-10T03:50:58.598736932Z","published_at":"2025-11-25T21:32:07Z","references":["https://osv.dev/vulnerability/GHSA-mw3v-mmfw-3x2g","https://nvd.nist.gov/vuln/detail/CVE-2025-9624","https://github.com/opensearch-project/OpenSearch/pull/19491","https://caverav.cl/posts/opensearch-dos/opensearch-dos","https://fluidattacks.com/advisories/chick","https://github.com/opensearch-project/OpenSearch","https://github.com/opensearch-project/OpenSearch/releases/tag/2.19.4","https://github.com/opensearch-project/OpenSearch/releases/tag/3.3.0","https://opensearch.org/blog/explore-opensearch-3-3"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-mw3v-mmfw-3x2g","url":"https://osv.dev/vulnerability/GHSA-mw3v-mmfw-3x2g"},{"source":"nvd","source_id":"CVE-2025-9624","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-9624"}],"summary":"OpenSearch is vulnerable to DoS via complex query_string inputs"}