OpenSearch v2.19.7 released

OpenSearch is the community-driven, open source search and analytics suite.

Version 2.19.7 is out. It is a hardening release with several fixes against crafted input, like StackOverflow and OOM conditions or a path traversal in the fs repository.

Version 2.19.7 Release Notes

Compatible with OpenSearch and OpenSearch Dashboards version 2.19.7

Enhancements

* Add upper bound for the hot_threads `snapshots` parameter with configurable `monitor.jvm.hot_threads.max_snapshots` cluster setting (#23144)
* Add `search.query.max_query_nesting_depth` setting to limit query_string parenthesis nesting depth and prevent StackOverflowError (#22854)
* Cap `max_determinized_states` in completion suggester regex and fuzzy options to prevent heap exhaustion (#22925)
* Disable Mustache partial template resolution in search templates (#22440)
* Reject out-of-range WLM node threshold updates at validation time (#22678)

Bug Fixes

* Fix unbounded recursion in JSON and binary deserialization that could cause StackOverflowError (#22427)
* Strengthen scroll_id validation to prevent OOM from crafted scroll IDs with oversized counts (#22401)
* Validate `base_path` in fs repository to prevent path traversal outside configured `path.repo` directories (#22381)
* Fix handling of unsupported zstd HTTP content encoding in netty4 and nio transports (#23324)

Dependency updates (Jackson, Log4j, Netty, Bouncy Castle, bundled JDK) are part of the release as well. Find the full release notes and downloads on the release page.

Happy hacking! :-)

• News
• Tools