CVE-2025-37731
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-37731
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-37731.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-37731
- Aliases
- Downstream
- Published
- 2025-12-15T11:15:39.707Z
- Modified
- 2025-12-18T21:48:44.907978Z
- Severity
-
- 7.4 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Improper Authentication in Elasticsearch PKI realm can lead to user impersonation via specially crafted client certificates. A malicious actor would need to have such a crafted client certificate signed by a legitimate, trusted Certificate Authority.
- References
Affected packages
Git / github.com/elastic/elasticsearch
Database specific
vanir_signatures
[
{
"target": {
"file": "libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java",
"function": "getLength"
},
"deprecated": false,
"source": "https://github.com/elastic/elasticsearch/commit/e34ace04b64e9bfa3f9e785b08e6d81f8efe314b",
"id": "CVE-2025-37731-7e790cab",
"digest": {
"length": 533.0,
"function_hash": "87673803415819436679596541002810312405"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"target": {
"file": "libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java"
},
"deprecated": false,
"source": "https://github.com/elastic/elasticsearch/commit/e34ace04b64e9bfa3f9e785b08e6d81f8efe314b",
"id": "CVE-2025-37731-ec99c0f8",
"digest": {
"line_hashes": [
"51550193863884045934320633866015297104",
"331630246968815451063354319351946329234",
"186592295080528027987154635525856192062",
"75995982543764003382939960430245009492"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1"
}
]
source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-37731.json"