CVE-2024-52981 — Uncontrolled Resource Consumption in Elasticsearch

CWE-400 — Uncontrolled Resource ConsumptionCWE-754 — Improper Check for Unusual or Exceptional Conditions7 documents6 sources
Severity
7.5HIGHNVD
CNA4.9
EPSS
0.3%
top 45.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Elastic Elasticsearch
Timeline
PublishedApr 8
Latest updateJul 11

Description

An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDelastic/elasticsearch7.17.0 — 7.17.24+1
▶CVEListV5elastic/elasticsearch7.17.0 — 7.17.23+1

Patches

Patch: discuss.elastic.co ↗

🔴Vulnerability Details

4
OSV
CVE-2024-52981: An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects cou↗2025-04-08
▶
CVEList
CVE-2024-52981: An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects cou↗2025-04-08
▶
GHSA
Elasticsearch Vulnerable to Stack Overflow due to a Large Recursion↗2025-04-08
▶
OSV
Elasticsearch Vulnerable to Stack Overflow due to a Large Recursion↗2025-04-08
▶

📋Vendor Advisories

2
Juniper
CVE-2025-52981: An Improper Check for Unusual or Exceptional Conditions vulnerability in the flow processing daemon (flowd) of Juniper Networks Junos OS on S↗2025-07-11
▶
Microsoft
An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.↗2025-04-08
▶
CVE-2024-52981 — Uncontrolled Resource Consumption | cvebase