Advisoriesby IbisElasticsearchGHSA-2cqf-6xv9-f22w
Elasticsearch vulnerable to Uncontrolled Resource Consumption
Fix: upgrade to 7.17.13 or later (2 fixed versions below)
An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to exit with an OutOfMemory error by sending a moderate number of malformed HTTP requests. The issue was identified by Elastic Engineering and we have no indication that the issue is known or that it is being exploited in the wild.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.elasticsearch:elasticsearch Maven | < 7.17.13 | 7.17.13 |
| >= 8.0.0, < 8.9.0 | 8.9.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-400
- Also known as
- BIT-elasticsearch-2023-31418, CVE-2023-31418
More Elasticsearch advisories
All Elasticsearch
Elasticsearch Uncaught Exception leading to crashCVE-2024-23449fixed in 8.11.1Elasticsearch Incorrect Authorization vulnerabilityCVE-2024-23451fixed in 8.13.0Elasticsearch Uncontrolled Resource Consumption vulnerabilityCVE-2024-23450fixed in 7.17.19 +1Elasticsearch Improper Handling of Exceptional ConditionsCVE-2023-46673fixed in 7.17.14 +1Elasticsearch allows insertion of sensitive information into log files when using deprecated URIsCVE-2023-31417fixed in 7.17.13 +1Elasticsearch vulnerable to stack overflow in the search APICVE-2023-31419fixed in 7.17.13 +1