Stack Overflow Vulnerability in Elasticsearch Affecting Nested GeometryCollection Objects
CVE-2024-52981

4.9MEDIUM

Key Information:

Vendor
Elastic
Status
Elastic
Vendor
CVE Published:
8 April 2025

Summary

A vulnerability has been identified in Elasticsearch that arises from excessive recursion when processing Well-KnownText formatted strings containing nested GeometryCollection objects. This flaw has the potential to trigger a stack overflow, leading to application crashes and service disruptions. Users of Elasticsearch are advised to review their configurations and update to the latest versions to mitigate the risks associated with this vulnerability.

Affected Version(s)

Elasticsearch 7.17.0 <= 7.17.23

Elasticsearch 8.0 <= 8.15.0

References

https://discuss.elastic.co/t/elasticsearch-7-17-24-and-8-...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.