ElasticsearchGHSA-w5gg-2q56-6h4f
Elasticsearch Uncontrolled Resource Consumption vulnerability
Medium4.9CVE-2024-23450 · Published Mar 27, 2024 · updated Sep 10, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.elasticsearch:elasticsearch Maven | >= 7.0.0, < 7.17.19 | 7.17.19 |
| >= 8.0.0, < 8.13.0 | 8.13.0 |
Details and references
A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-400
- Also known as
- BIT-elasticsearch-2024-23450, CVE-2024-23450
More Elasticsearch advisories
All Elasticsearch| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 272024 | Elasticsearch Incorrect Authorization vulnerability CVE-2024-23451Medium4.4fixed in 8.13.0 | Medium4.4 | 8.13.0 |
| Mar 292024 | Elasticsearch Uncaught Exception leading to crash CVE-2024-23449Medium4.3fixed in 8.11.1 | Medium4.3 | 8.11.1 |
| Jun 132024 | Elasticsearch StackOverflow vulnerability CVE-2024-37280Medium4.9fixed in 8.14.0 | Medium4.9 | 8.14.0 |
| Jul 262024 | Elasticsearch Insertion of Sensitive Information into Log File CVE-2023-49921Medium5.2fixed in 7.17.16, 8.11.2 | Medium5.2 | 7.17.16, 8.11.2 |
| Nov 222023 | Elasticsearch Improper Handling of Exceptional Conditions CVE-2023-46673Medium6.5fixed in 7.17.14, 8.10.3 | Medium6.5 | 7.17.14, 8.10.3 |
| Jul 312024 | Elasticsearch stores private key on disk unencrypted CVE-2024-23444Medium4.9fixed in 7.17.23, 8.13.0 | Medium4.9 | 7.17.23, 8.13.0 |