VYPR
← All advisories
Moderate severityNVD Advisory· Published Mar 27, 2024· Updated Feb 13, 2025

Elasticsearch Uncontrolled Resource Consumption vulnerability

CVE-2024-23450

Description

A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A denial-of-service vulnerability in Elasticsearch allows a high-privileged attacker to crash an ingest node by sending a document through a deeply nested pipeline.

Vulnerability

Overview

CVE-2024-23450 is an uncontrolled resource consumption vulnerability in Elasticsearch. Processing a document through a deeply nested ingest pipeline on an ingest node causes the node to crash [1][4]. The root cause is uncontrolled resource consumption triggered by the excessive depth of pipeline processing, leading to a crash [1].

Exploitation

To exploit this vulnerability, an attacker must have high privileges (such as an ingest user) and the ability to submit a document to a deeply nested pipeline [4]. No user interaction is required beyond submitting the crafted request, and the attack is performed over the network [4]. The vulnerability affects Elasticsearch versions 7.0.0 to 7.17.19 and 8.0.0 to 8.13.0 [4].

Impact

Successful exploitation results in a denial-of-service condition, causing the Elasticsearch node to crash [1][4]. This can disrupt service availability by crashing a node, potentially affecting cluster stability if the node is critical.

Mitigation

Elastic has released fixed versions: 7.17.19 and 8.13.0 [4]. Users should upgrade to these versions or later to remediate the vulnerability. No workarounds are mentioned in available sources. The vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog.

References
  1. NVD - CVE-2024-23450
  2. Elasticsearch 8.13.0 / 7.17.19 Security Update (ESA-2024-06)

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.elasticsearch:elasticsearchMaven
>= 7.0.0, < 7.17.197.17.19
org.elasticsearch:elasticsearchMaven
>= 8.0.0, < 8.13.08.13.0

Affected products

142

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

6

News mentions

0

No linked articles in our index yet.