OpenSearch 3.9.0 Release Notes

{
  "id": "9b23b8208d957edec808d28617dc631e8aa2aa07d7e78b2ab06e8d19ed538f81",
  "url": "https://github.com/opensearch-project/OpenSearch/releases/tag/3.9.0",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "OpenSearch 3.9.0 Release Notes",
    "summary": "OpenSearch 3.9.0 includes a fix for completion-suggester heap exhaustion and updates bundled log4j. The notes associate CVE-2026-63136 with the completion-suggester fix but do not explicitly say the release fixes that CVE; they also mention CVE-2026-49844 alongside the log4j update without an explicit remediation relationship.",
    "evidence": "Bound completion suggester max_determinized_states to prevent heap exhaustion (CVE-2026-63136) (#22924)",
    "products": [
      {
        "name": {
          "value": "OpenSearch",
          "evidence": "Release notes from OpenSearch"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "3.9.0",
            "evidence": "Version 3.9.0 Release Notes"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2026-63136",
        "evidence": "Bound completion suggester max_determinized_states to prevent heap exhaustion (CVE-2026-63136) (#22924)"
      },
      {
        "value": "CVE-2026-49844",
        "evidence": "Update log4j to 2.25.5 (CVE-2026-49844) (#22923)"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "github-opensearch-project-opensearch",
  "document_id": 22037,
  "published_at": "2026-10-20T22:17:25+00:00"
}