Advisoriesby IbisElasticsearchGHSA-mm3m-5497-xggg
Elasticsearch Uncontrolled Resource Consumption Vulnerability
Fix: upgrade to 7.17.25 or later (2 fixed versions below)
Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.elasticsearch:elasticsearch Maven | < 7.17.25 | 7.17.25 |
| >= 8.0.0-alpha1, < 8.16.0 | 8.16.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-400
- Also known as
- BIT-elasticsearch-2024-52979, CVE-2024-52979
- nvd.nist.gov/vuln/detail/CVE-2024-52979
- github.com/elastic/elasticsearch/pull/114002
- github.com/elastic/elasticsearch/commit/cbde7f456d7ccd98556302fccf3238bb4557fc91
- github.com/elastic/elasticsearch/commit/f9b6b57d1d0f76e2d14291c04fb50abeb642cfbf
- discuss.elastic.co/t/elasticsearch-7-17-25-and-8-16-0-security-update-esa-2024-40/377709
- github.com/elastic/elasticsearch
More Elasticsearch advisories
All Elasticsearch
Elasticsearch: improper authenticationCVE-2025-37731fixed in 8.19.8 +2Elasticsearch: Insertion of Sensitive Information into Log File via reindex APICVE-2025-37727fixed in 8.18.8 +3Elasticsearch Vulnerable to Stack Overflow due to a Large RecursionCVE-2024-52981fixed in 7.17.24 +1Elasticsearch Potential Node Crash due to Large Recursion in `innerForbidCircularReferences` FunctionCVE-2024-52980fixed in 8.15.1Elasticsearch allocation of resources without limits or throttling leads to crashCVE-2024-43709fixed in 7.17.21 +1Elasticsearch Incorrect Authorization vulnerabilityCVE-2024-12539fixed in 8.16.2