Elasticsearch Crashes Due to Deeply Nested Pipeline Processing
CVE-2024-23450

7.5HIGH

Key Information:

Vendor
Elastic
Status
Elasticsearch
Vendor
CVE Published:
27 March 2024

Summary

A flaw has been identified in Elasticsearch that impacts its stability during the processing of documents in deeply nested pipelines on ingest nodes. When such documents are processed, it can lead to a crash of the Elasticsearch node, interrupting service and potentially causing data unavailability.

Affected Version(s)

Elasticsearch 7.0.0 < 7.17.19

Elasticsearch 8.0.0 < 8.13.0

References

https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-19...
https://www.elastic.co/community/security
https://security.netapp.com/advisory/ntap-20240517-0010/

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.