medium6.5
CVE-2024-52979
Elasticsearch Uncontrolled Resource Consumption Vulnerability
Impact
Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.elasticsearch:elasticsearch | < 7.17.25 | 7.17.25 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Elastic | Elasticsearch | before 7.17.25 from 8.0.0 before 8.16.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://discuss.elastic.co/t/elasticsearch-7-17-25-and-8-16-0-security-update-esa-2024-40/377709
- https://github.com/advisories/GHSA-mm3m-5497-xggg
- https://nvd.nist.gov/vuln/detail/CVE-2024-52979
- https://github.com/elastic/elasticsearch/pull/114002
- https://github.com/elastic/elasticsearch/commit/cbde7f456d7ccd98556302fccf3238bb4557fc91
- https://github.com/elastic/elasticsearch/commit/f9b6b57d1d0f76e2d14291c04fb50abeb642cfbf