CVE-2023-46673
Description
It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Malformed scripts in Elasticsearch Ingest Pipeline’s script processor can crash a node when using the Simulate Pipeline API, leading to denial of service.
Root
Cause
The vulnerability resides in the script processor of an Ingest Pipeline. A malformed script, when processed by the Simulate Pipeline API, triggers an improper handling of exceptional conditions, resulting in a node crash [4].
Exploitation
To exploit this vulnerability, an attacker must have authenticated access to the Elasticsearch cluster and be able to call the Simulate Pipeline API with a crafted pipeline containing a malformed script. No special privileges beyond the ability to create or simulate pipelines are required [4].
Impact
Successful exploitation causes the target Elasticsearch node to crash, leading to a denial of service. This can disrupt availability of the cluster, especially if multiple nodes are affected or if the node holds critical roles. The crash does not lead to data loss or confidentiality breach [4].
Mitigation
The issue is resolved in Elasticsearch versions 7.17.14 and 8.10.3. Users running versions between 7.0.0 and 7.17.14, or between 8.0.0 and 8.10.3, should upgrade immediately. No workarounds have been published [4].
AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.elasticsearch:elasticsearchMaven | >= 7.0.0, < 7.17.14 | 7.17.14 |
org.elasticsearch:elasticsearchMaven | >= 8.0.0, < 8.10.3 | 8.10.3 |
Affected products
3- osv-coords2 versions
>= 7.0.0, < 7.17.14+ 1 more
- (no CPE)range: >= 7.0.0, < 7.17.14
- (no CPE)range: >= 7.0.0, < 7.17.14
- Range: 7.0.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4News mentions
0No linked articles in our index yet.