CVE-2024-23450 — Uncontrolled Resource Consumption in Elasticsearch

CWE-400 — Uncontrolled Resource Consumption6 documents5 sources
Severity
7.5HIGHNVD
CNA4.9
EPSS
1.0%
top 22.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Elasticsearch
Timeline
PublishedMar 27

Description

A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5elastic/elasticsearch7.0.0 — 7.17.19+1
▶NVDelastic/elasticsearch7.0.0 — 7.17.19+1

🔴Vulnerability Details

4
GHSA
Elasticsearch Uncontrolled Resource Consumption vulnerability↗2024-03-27
▶
OSV
Elasticsearch Uncontrolled Resource Consumption vulnerability↗2024-03-27
▶
CVEList
Elasticsearch Uncontrolled Resource Consumption vulnerability↗2024-03-27
▶
OSV
CVE-2024-23450: A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node t↗2024-03-27
▶

📋Vendor Advisories

1
Red Hat
elasticsearch: Possible denial of service when processing documents in a deeply nested pipeline↗2024-03-27
▶
CVE-2024-23450 — Uncontrolled Resource Consumption | cvebase