Medium WID-SEC-2025-0923 1 CVE

Elasticsearch: Schwachstelle ermöglicht Denial of Service

Published May 1, 2025 · Updated May 1, 2025 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Elasticsearch ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Elasticsearch ist eine Open Source, verteilte Echtzeit-Suche und Analyse-Engine.

Vulnerabilities 1

Medium 6.5

CVE-2024-52979

Elasticsearch Uncontrolled Resource Consumption vulnerability

Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.

Elastic Elasticsearch elasticsearch org.elasticsearch:elasticsearch Ubuntu Maven

May 1, 2025

Revision history

2025-05-01 #1
Initiale Fassung

References

Elasticsearch 7.17.25 and 8.16.0 Security Update vom 2025-05-01
https://discuss.elastic.co/t/elasticsearch-7-17-25-and-8-16-0-security-update-esa-2024-40/377709
NIST CVE-2024-52979
https://nvd.nist.gov/vuln/detail/CVE-2024-52979