CVE-2024-23450

Elasticsearch Uncontrolled Resource Consumption vulnerability

4.9 MediumFix available

A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.25%Up 1.2 points since Mar 28, 2024

What each source reports

CVE List Score used 4.9

Elasticsearch Uncontrolled Resource Consumption vulnerability

A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.

Record: CVE-2024-23450
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

EUVDEUVD-2024-1021 4.9

A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.

Record: EUVD-2024-1021
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w5gg-2q56-6h4f 4.9

Elasticsearch Uncontrolled Resource Consumption vulnerability

A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.

Record: GHSA-w5gg-2q56-6h4f
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

NVD 4.9

A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.

Record: CVE-2024-23450
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSV 4.9

Elasticsearch Uncontrolled Resource Consumption vulnerability

A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.

Record: CVE-2024-23450
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSVGHSA-w5gg-2q56-6h4f 4.9

Elasticsearch Uncontrolled Resource Consumption vulnerability

A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.

Record: GHSA-w5gg-2q56-6h4f
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-23450 4.9

A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.

Record: UBUNTU-CVE-2024-23450
CVSS 3.1: 4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBIT-elasticsearch-2024-23450 No score

Elasticsearch Uncontrolled Resource Consumption vulnerability

A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.

Record: BIT-elasticsearch-2024-23450
Updated: 2026-11-02

Affected products

elastic elasticsearch

Affected packages

Affected packages
Package	Affected	Fixed
`org.elasticsearch:elasticsearch` Maven	7.0.0 up to 7.17.19	7.17.19
`org.elasticsearch:elasticsearch` Maven	8.0.0 up to 8.13.0	8.13.0
`elasticsearch` Bitnami	7.0.0 up to 7.17.19, 8.0.0 up to 8.13.0	7.17.198.13.0
`org.elasticsearch:elasticsearch` Maven	7.0.0 up to 7.17.19, plus listed versions 7.0.17.1.07.1.17.10.07.10.1 Show 45 moreShow less 7.10.27.11.07.11.17.11.27.12.07.12.17.13.07.13.17.13.27.13.37.13.47.14.07.14.17.14.27.15.07.15.17.15.27.16.07.16.17.16.27.16.37.17.07.17.17.17.107.17.117.17.127.17.137.17.147.17.157.17.167.17.177.17.187.17.27.17.37.17.47.17.57.17.67.17.77.17.87.17.97.2.07.2.17.3.07.3.17.3.2	7.17.19
`org.elasticsearch:elasticsearch` Maven	8.0.0 up to 8.13.0, plus listed versions 8.0.18.1.08.1.18.1.28.1.3 Show 40 moreShow less 8.10.08.10.18.10.28.10.38.10.48.11.08.11.18.11.28.11.38.11.48.12.08.12.18.12.28.2.08.2.18.2.28.2.38.3.08.3.18.3.28.3.38.4.08.4.18.4.28.4.38.5.08.5.18.5.28.5.38.6.08.6.18.6.28.7.08.7.18.8.08.8.18.8.28.9.08.9.18.9.2	8.13.0
`elasticsearch` Ubuntu:16.04:LTS	All versions, plus listed versions 1.6.2+dfsg-11.7.3+dfsg-11.7.3+dfsg-21.7.3+dfsg-3	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-23450 is a medium vulnerability (CVSS 4.9) in Elastic Elasticsearch, published March 27, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. Fixed in org.elasticsearch:elasticsearch 7.17.19.

References

This page doesn't list everything

Left out here: 17 versions. The JSON record has them.