GHSA-mm3m-5497-xggg

Elasticsearch Uncontrolled Resource Consumption Vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-52979

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.elasticsearch:elasticsearch	< 7.17.25	7.17.25
Maven	org.elasticsearch:elasticsearch	>= 8.0.0-alpha1, < 8.16.0	8.16.0

Details

As written in the advisory (Markdown source, shown as plain text).

Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-52979 advisory
https://github.com/elastic/elasticsearch/pull/114002 web
https://github.com/elastic/elasticsearch/commit/cbde7f456d7ccd98556302fccf3238bb4557fc91 web
https://github.com/elastic/elasticsearch/commit/f9b6b57d1d0f76e2d14291c04fb50abeb642cfbf web
https://discuss.elastic.co/t/elasticsearch-7-17-25-and-8-16-0-security-update-esa-2024-40/377709 web
https://github.com/elastic/elasticsearch package