CVE-2021-22144
Denial of Service in Elasticsearch
In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
6.5
In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.
- Record
CVE-2021-22144- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:N/A:P - Weakness
- CWE-674
- Updated
- 2026-11-02
CVE List No score
In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.
- Record
CVE-2021-22144- Updated
- 2026-11-02
EUVDEUVD-2021-1526 No score
In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.
- Record
EUVD-2021-1526- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3393-hvrj-w7v3
5.7
Denial of Service in Elasticsearch
In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.
- Record
GHSA-3393-hvrj-w7v3- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-674
- Updated
- 2026-11-02
OSV
6.5
In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.
- Record
CVE-2021-22144- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-3393-hvrj-w7v3
5.7
Denial of Service in Elasticsearch
In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.
- Record
GHSA-3393-hvrj-w7v3- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-674
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-22144
6.5
In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.
- Record
UBUNTU-CVE-2021-22144- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-elasticsearch-2021-22144 No score
In Elasticsearch versions before 7.13.3 and 6.8.17 an uncontrolled recursion vulnerability that could lead to a denial of service attack was identified in the Elasticsearch Grok parser. A user with the ability to submit arbitrary queries to Elasticsearch could create a malicious Grok query that will crash the Elasticsearch node.
- Record
BIT-elasticsearch-2021-22144- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.elasticsearch:elasticsearchMaven |
before 6.8.17 | 6.8.17 |
org.elasticsearch:elasticsearchMaven |
7.0.0-alpha1 up to 7.13.3 | 7.13.3 |
elasticsearchBitnami |
before 6.8.17, 7.0.0 up to 7.13.3 | 6.8.177.13.3 |
org.elasticsearch:elasticsearchMaven |
before 6.8.17, plus listed versions 0.10.00.11.00.12.00.12.10.13.0 Show 45 moreShow less0.13.10.14.00.14.10.14.20.14.30.14.40.15.00.15.10.15.20.16.00.16.10.16.20.16.30.16.40.16.50.17.00.17.10.17.100.17.20.17.30.17.40.17.50.17.60.17.70.17.80.17.90.18.00.18.10.18.20.18.30.18.40.18.50.18.60.18.70.19.00.19.0.RC10.19.0.RC20.19.0.RC30.19.10.19.100.19.110.19.120.19.20.19.30.19.4 |
6.8.17 |
org.elasticsearch:elasticsearchMaven |
7.0.0-alpha1 up to 7.13.3, plus listed versions 7.0.07.0.0-alpha27.0.0-beta17.0.0-rc17.0.0-rc2 Show 36 moreShow less7.0.17.1.07.1.17.10.07.10.17.10.27.11.07.11.17.11.27.12.07.12.17.13.07.13.17.13.27.2.07.2.17.3.07.3.17.3.27.4.07.4.17.4.27.5.07.5.17.5.27.6.07.6.17.6.27.7.07.7.17.8.07.8.17.9.07.9.17.9.27.9.3 |
7.13.3 |
elasticsearchUbuntu:16.04:LTS |
All versions, plus listed versions 1.6.2+dfsg-11.7.3+dfsg-11.7.3+dfsg-21.7.3+dfsg-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-22144 is a medium vulnerability (CVSS 6.5) in Elastic Elasticsearch, published July 26, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.44%, the 84th percentile. Fixed in org.elasticsearch:elasticsearch 6.8.17.
References
oracle.com/security-alerts/cpuapr2022.html
discuss.elastic.co/t/elasticsearch-7-13-3-and-6-8-17-security-update/278100
security.netapp.com/advisory/ntap-20210827-0006
nvd.nist.gov/vuln/detail/CVE-2021-22144
github.com/advisories/GHSA-3393-hvrj-w7v3
ubuntu.com/security/CVE-2021-22144
cve.org/CVERecord?id=CVE-2021-22144
Left out here: 203 versions. The JSON record has them.