OpenSearch Dashboards Capabilities Route Unbounded Payload DOS
CVE-2026-75897 Published on August 18, 2026
Uncontrolled Resource Consumption in Capabilities Route in OpenSearch Dashboards
Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.
Vulnerability Analysis
CVE-2026-75897 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.
Weakness Type
Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
Products Associated with CVE-2026-75897
stack.watch emails you whenever new vulnerabilities are published in Opensearch Dashboards or Aws Amazon Opensearch Service. Just hit a watch button to start following.
Affected Versions
OpenSearch Dashboards:- Version 1.3, <= 3.7.0 is affected.
- Version 1.3, <= 3.5 is affected.