GitHub Advisoryadvisory · Maven
GHSA-mm3m-5497-xggg Elasticsearch Uncontrolled Resource Consumption Vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2024-52979
- Ecosystem
- Maven
- Packages
- org.elasticsearch:elasticsearch
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-400
- Reviewed
- 2025-10-02
Affected packages
• Maven org.elasticsearch:elasticsearch: < 7.17.25 → fixed in 7.17.25
• Maven org.elasticsearch:elasticsearch: >= 8.0.0-alpha1, < 8.16.0 → fixed in 8.16.0
Description
Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.
Related
Alias · CVE (1)
- CVE-2024-52979 Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead… vulnerability
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-52979 advisory
- https://github.com/elastic/elasticsearch/pull/114002 web
- https://github.com/elastic/elasticsearch/commit/cbde7f456d7ccd98556302fccf3238bb4557fc91 web
- https://github.com/elastic/elasticsearch/commit/f9b6b57d1d0f76e2d14291c04fb50abeb642cfbf web
- https://discuss.elastic.co/t/elasticsearch-7-17-25-and-8-16-0-security-update-esa-2024-40/377709 web
- https://github.com/elastic/elasticsearch package