Every CVE Search/ Get API key

CVE-2024-37280

Elasticsearch StackOverflow vulnerability

4.9 MediumFix available

A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type. Under certain circumstances, ingesting documents in this index would cause a StackOverflow exception to be thrown and ultimately lead to a Denial of Service. Note that passthrough fields is an experimental feature.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.62%Up 0.6 points since Jun 14, 2024
90%50%10%1%

What each source reports

CVE List Score used 4.9

Elasticsearch StackOverflow vulnerability

A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type. Under certain circumstances, ingesting documents in this index would cause a StackOverflow exception to be thrown and ultimately lead to a Denial of Service. Note that passthrough fields is an experimental feature.

Record
CVE-2024-37280
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-122
Updated
2026-11-02
EUVDEUVD-2024-1914 4.9

A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type. Under certain circumstances, ingesting documents in this index would cause a StackOverflow exception to be thrown and ultimately lead to a Denial of Service. Note that passthrough fields is an experimental feature.

Record
EUVD-2024-1914
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-4q22-422g-m4pj 4.9

Elasticsearch StackOverflow vulnerability

A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type. Under certain circumstances, ingesting documents in this index would cause a StackOverflow exception to be thrown and ultimately lead to a Denial of Service. Note that passthrough fields is an experimental feature.

Record
GHSA-4q22-422g-m4pj
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-122, CWE-787
Updated
2026-11-02
NVD 4.9

A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type. Under certain circumstances, ingesting documents in this index would cause a StackOverflow exception to be thrown and ultimately lead to a Denial of Service. Note that passthrough fields is an experimental feature.

Record
CVE-2024-37280
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-122, CWE-787
Updated
2026-11-02
OSV 4.9

Elasticsearch StackOverflow vulnerability

A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type. Under certain circumstances, ingesting documents in this index would cause a StackOverflow exception to be thrown and ultimately lead to a Denial of Service. Note that passthrough fields is an experimental feature.

Record
CVE-2024-37280
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-122
Updated
2026-11-02
OSVGHSA-4q22-422g-m4pj 4.9

Elasticsearch StackOverflow vulnerability

A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type. Under certain circumstances, ingesting documents in this index would cause a StackOverflow exception to be thrown and ultimately lead to a Denial of Service. Note that passthrough fields is an experimental feature.

Record
GHSA-4q22-422g-m4pj
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-122, CWE-787
Updated
2026-11-02
OSVUBUNTU-CVE-2024-37280 4.9

A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type. Under certain circumstances, ingesting documents in this index would cause a StackOverflow exception to be thrown and ultimately lead to a Denial of Service. Note that passthrough fields is an experimental feature.

Record
UBUNTU-CVE-2024-37280
CVSS 3.1
4.9 MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVBIT-elasticsearch-2024-37280 No score

Elasticsearch StackOverflow vulnerability

A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of “passthrough” type. Under certain circumstances, ingesting documents in this index would cause a StackOverflow exception to be thrown and ultimately lead to a Denial of Service. Note that passthrough fields is an experimental feature.

Record
BIT-elasticsearch-2024-37280
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.elasticsearch:elasticsearch
Maven
8.13.1 up to 8.14.0
8.14.0
elasticsearch
Bitnami
8.13.1 up to 8.14.0
8.14.0
org.elasticsearch:elasticsearch
Maven
8.13.1 up to 8.14.0, plus listed versions
8.13.28.13.38.13.4
8.14.0
elasticsearch
Ubuntu:16.04:LTS
All versions, plus listed versions
1.6.2+dfsg-11.7.3+dfsg-11.7.3+dfsg-21.7.3+dfsg-3
None known

History

History
RecordedChangedSources
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-37280 is a medium vulnerability (CVSS 4.9) in Elastic Elasticsearch, published June 13, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 49th percentile. Fixed in org.elasticsearch:elasticsearch 8.14.0.

References

MoveEnter Open