CVE-2024-52980CWE-400
Elasticsearch Uncontrolled Resource Consumption vulnerability
Medium · published April 8, 2025
What it is
A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash.
A successful attack requires a malicious user to have read_pipeline Elasticsearch cluster privilege assigned to them.
The record
Technical detail
- CVSS v3.1
- 6.5 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00547 · 45.0th percentile
- Weakness
- CWE-400 · Uncontrolled Resource Consumption
- Published
- 2025-04-08T16:43Z
EPSS history
Timeline