OpenSearch S3_CUSTOM threat intel source: NoClassDefFoundError … AfterburnerModule, and the node exits.

How to check yours

Both checks are read-only. Run them on one node.

1. Is it this bug? Search the node log for the class name:

   grep -n "AfterburnerModule\|InputCodecSchema\|fatal error in thread" /usr/share/opensearch/logs/*.log

   A hit on InputCodecSchema.<clinit> or Could not initialize class …InputCodecSchema means you are looking at this note.
2. Is the class in your install?

   cd /usr/share/opensearch
   for j in $(find plugins lib modules -name '*.jar'); do
     unzip -l "$j" 2>/dev/null | grep -q 'jackson/module/afterburner/AfterburnerModule' && echo "$j"
   done

   No output means no jar provides it. In the 3.8.0 image we got no output from 913 jars.

1. What happens, measured

We started opensearchproject/opensearch:3.8.0 as one node with the security plugin disabled and --network none, so no request could leave the container. Then we sent the reporter’s exact body to the connection test:

POST /_plugins/_security_analytics/connections/s3/test
{"bucket_name":"test-bucket","object_key":"iocs.ndjson",
 "region":"eu-central-1","role_arn":"arn:aws:iam::123456789012:role/test-role"}

curl got no response. The node log showed:

fatal error in thread [Thread-8], exiting
java.lang.NoClassDefFoundError: com/fasterxml/jackson/module/afterburner/AfterburnerModule
  at org.opensearch.securityanalytics.commons.connector.model.InputCodecSchema.<clinit>(InputCodecSchema.java:20)
  at org.opensearch.securityanalytics.services.STIX2IOCFetchService.constructS3Connector(STIX2IOCFetchService.java:276)
  at org.opensearch.securityanalytics.services.STIX2IOCFetchService.testS3ClientConnection(STIX2IOCFetchService.java:229)
  at org.opensearch.securityanalytics.services.STIX2IOCFetchService.testS3Connection(STIX2IOCFetchService.java:221)
  at org.opensearch.securityanalytics.transport.TransportTestS3ConnectionAction.doExecute(TransportTestS3ConnectionAction.java:41)

and the container stopped with exit code 1. Same result on a second fresh run, and on one run of 3.9.0 with the same script. Because the node was already gone, we could not run the second step (creating the S3_CUSTOM source) on either version.

The failure is in a static initialiser (<clinit>), so it happens the first time anything touches InputCodecSchema, whatever the bucket, region or role. A NoClassDefFoundError is an Error, not an Exception; OpenSearch treats an uncaught Error on a thread as fatal and exits.

Why the class is missing

In the 3.8.0 image, security-analytics-commons-1.0.0.jar is 12,642,708 bytes and has no com/fasterxml/jackson entries. Across all 913 jars under plugins, lib and modules, none contains AfterburnerModule. The issue quotes build.gradle: Jackson is left out of the commons jar “to avoid jar hell with alerting plugin” and is expected from the alerting plugin at runtime. In the 3.8.0 image we scanned, no jar under plugins, lib or modules, the alerting plugin’s included, provides AfterburnerModule; the reporter found the same in 3.9.0.

Our lab and the issue report differ on the first step

The reporter, on 3.9.0, got a 500 from the connection test, and the node exited only when they created the source. In our lab the connection test itself took the node down, on 3.8.0 and on 3.9.0. Their 500 was a security_exception, so their node had the security plugin on; ours did not. We have not tested with it on, and that may be the difference. In both reports, a call that loads this code path stopped the node.

2. Which versions

Of the releases we tested, 3.6.0 is the newest where the connection test did not take the node down. With no network it answered HTTP 200 with {"status":"FORBIDDEN","error":"Resource not found."}: an ordinary error reply, not a crash. There the commons jar still bundles Jackson, including AfterburnerModule. The two jar sizes match the figures the issue gives for the commons jar before and after it was rebuilt (18.7 MB and 12.6 MB). We did not check which release first shipped the smaller jar, and we did not test 3.5.0 or older.

3. What to do until it is fixed

• Do not call the S3 connection test or create an S3_CUSTOM source on a node you care about. On 3.8.0 and 3.9.0 one call was enough to stop the node in our lab. Test it on a throwaway node first if you need to know how your version behaves.
• Getting IOCs in without S3: download the IOC file from your bucket with your own tooling and create an IOC_UPLOAD source instead. On 3.9.0, with no S3 call made first, this returned HTTP 201, the IOC was listed by GET /_plugins/_security_analytics/threat_intel/iocs, and the node stayed up with no NoClassDefFoundError. We measured one run with a single ipv4-addr IOC and the source set to enabled: false:

  POST /_plugins/_security_analytics/threat_intel/sources
  {"name":"t1851_upload","format":"STIX2","type":"IOC_UPLOAD",
   "enabled":false,"ioc_types":["ipv4-addr"],
   "source":{"ioc_upload":{"file_name":"lab.ndjson","iocs":[
     {"id":"ioc-1","name":"192.0.2.10","type":"ipv4-addr","value":"192.0.2.10",
      "severity":"high","spec_version":"2.1","description":"lab ioc"}]}}}

• URL_DOWNLOAD is not a way round it: on 3.9.0 the REST API refused it with HTTP 400, URL_DOWNLOAD source type cannot be created via the REST API. It is reserved for internal use only. The node stayed up.
• Adding the missing jars by hand (measured, not recommended): on 3.9.0, adding jackson-module-afterburner-2.22.2.jar alone moved the crash to a second missing class, JavaTimeModule. Adding jackson-datatype-jsr310-2.22.2.jar as well stopped the exit, but the connection test then failed with HTTP 500, No CLIENT_ENDPOINT_PROVIDER was configured, a separate AWS SDK error. We do not suggest it as a fix.
• If you are still on 3.6.0, staying there avoided the crash in our lab (one run). We did not test downgrading an existing node; read the OpenSearch upgrade documentation before trying it.

Follow security-analytics#1851 for the upstream fix.

Limits of what we measured

Stock opensearchproject/opensearch 3.8.0 (28 October 2026, two runs), 3.9.0, 3.7.0 and 3.6.0 (29 October 2026), one node, security plugin off, plain HTTP, no network, in our test container. 3.6.0 and 3.7.0 were run once each, on 29 October 2026. We did not reach S3_CUSTOM source creation on 3.7.0 to 3.9.0, and did not test it with a schedule. Not measured: the security plugin on, real S3 with real credentials, a cluster, OpenSearch Dashboards, 3.5.0 or older, and IOC_UPLOAD with a large IOC set or inside a working detector.