CVE-2024-43709 — Allocation of Resources Without Limits or Throttling in Elasticsearch

CWE-770 — Allocation of Resources Without Limits or Throttling7 documents6 sources

Severity

7.5HIGHNVD

CNA6.5

EPSS

0.9%

top 24.27%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Elastic Elasticsearch

Timeline

PublishedJan 21

Latest updateApr 15

Description

An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5elastic/elasticsearch7.17.0, 8.0.0 — 7.17.21, 8.13.3

▶NVDelastic/elasticsearch7.17.0 — 7.17.21+1

🔴Vulnerability Details

CVEList

Elasticsearch allocation of resources without limits or throttling leads to crash↗2025-01-21

▶

OSV

CVE-2024-43709: An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a speciall↗2025-01-21

▶

OSV

Elasticsearch allocation of resources without limits or throttling leads to crash↗2025-01-21

▶

GHSA

Elasticsearch allocation of resources without limits or throttling leads to crash↗2025-01-21

▶

📋Vendor Advisories

Oracle

Oracle Oracle Communications Applications Risk Matrix: Core (Elasticsearch) — CVE-2024-43709↗2025-04-15

▶

Red Hat

elasticsearch: Elasticsearch allocation of resources without limits or throttling leads to crash↗2025-01-21

▶