Elasticsearch Uncontrolled Resource Consumption vulnerability

CVE-2024-23450 · Published Mar 27, 2024 · updated Sep 10, 2026

Medium4.9

Fix: upgrade to 7.17.19 or later (2 fixed versions below)

A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.

Affected versions

Package	Affected	Fixed in
org.elasticsearch:elasticsearch Maven	>= 7.0.0, < 7.17.19	7.17.19
	>= 8.0.0, < 8.13.0	8.13.0

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Severity from: GitHub (reviewed advisory)
Weakness: CWE-400
Also known as: BIT-elasticsearch-2024-23450, CVE-2024-23450

More Elasticsearch advisories

All Elasticsearch

Medium 4.9Jul 31, 2024

Elasticsearch stores private key on disk unencryptedCVE-2024-23444fixed in 7.17.23 +1 Medium 5.2Jul 26, 2024

Elasticsearch Insertion of Sensitive Information into Log FileCVE-2023-49921fixed in 7.17.16 +1 Medium 4.9Jun 13, 2024

Elasticsearch StackOverflow vulnerabilityCVE-2024-37280fixed in 8.14.0 Medium 4.3Mar 29, 2024

Elasticsearch Uncaught Exception leading to crashCVE-2024-23449fixed in 8.11.1 Medium 4.4Mar 27, 2024

Elasticsearch Incorrect Authorization vulnerabilityCVE-2024-23451fixed in 8.13.0 Medium 6.5Nov 22, 2023

Elasticsearch Improper Handling of Exceptional ConditionsCVE-2023-46673fixed in 7.17.14 +1