org.opensearch.dataprepper.plugins vulnerabilities

Products

• org.opensearch.dataprepper.plugins/geoip-processor 2
• org.opensearch.dataprepper.plugins/opensearch 1

Latest org.opensearch.dataprepper.plugins CVEs

Newest publication first

1. GHSA-3xgr-h5hq-7299 GeoIP processor disables SSL certificate validation when downloading databases

   Published 2025-10-15

   Medium·CVSS 5.9

   Impact The GeoIP processor in Data Prepper was configured to trust all SSL certificates and disable hostname verification when downloading GeoIP databases from HTTP URLs, making downloads vulnerable to man-in-the-middle attacks. The GeoIP processor included a custom SSL implement...

2. GHSA-28gg-8qqj-fhh5 OpenSearch Data Prepper uses deprecated SSL protocol identifier

   Published 2025-10-15

   Medium·CVSS 4.8

   Impact The GeoIP processor and Kafka source and buffer were using the deprecated "SSL" protocol identifier when creating SSL contexts, potentially allowing the use of insecure SSL protocols instead of modern TLS versions. Multiple Data Prepper plugins used SSLContext.getInstance(...

3. CVE-2025-62371 OpenSearch Data Prepper plugins trusts all SSL certificates by default

   Published 2025-10-15

   High·CVSS 7.4 EPSS 0.19%

   OpenSearch Data Prepper as an open source data collector for observability data. In versions prior to 2.12.2, the OpenSearch sink and source plugins in Data Prepper trust all SSL certificates by default when no certificate path is provided. Prior to this fix, the OpenSearch sink...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.