CVE-2024-23450: Elasticsearch Uncontrolled Resource Consumption vulnerability
Published Mar 27, 2024
·Updated
A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.
Affected Software
4 affected componentsFixes available
maven/org.elasticsearch:elasticsearch>=8.0.0<8.13.0
8.13.0
maven/org.elasticsearch:elasticsearch>=7.0.0<7.17.19
7.17.19
Elastic Elasticsearch>=7.0.0<7.17.19
Elastic Elasticsearch>=8.0.0<8.13.0
Event History
Mar 27, 2024
CVE Published
via MITRE·05:03 PM
Data Sourced
via MITRE·05:03 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeakness
Advisory Published
via GitHub·06:32 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-23450?
CVE-2024-23450 is classified as a high-severity vulnerability due to its potential to crash an Elasticsearch node.
2
How do I fix CVE-2024-23450?
To mitigate CVE-2024-23450, upgrade your Elasticsearch installation to version 8.13.0 or 7.17.19.
3
What affected versions are vulnerable to CVE-2024-23450?
CVE-2024-23450 affects Elasticsearch versions between 8.0.0 and 8.13.0, as well as versions between 7.0.0 and 7.17.19.
4
What is the impact of CVE-2024-23450 on Elasticsearch performance?
The impact of CVE-2024-23450 is a potential crash of the Elasticsearch node when processing documents in deeply nested pipelines.
5
Is CVE-2024-23450 a remote code execution vulnerability?
CVE-2024-23450 is not a remote code execution vulnerability, but it can lead to denial of service by crashing the node.