CVE-2024-52981
Elasticsearch Vulnerable to Stack Overflow due to a Large Recursion
An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.
- Record
CVE-2024-52981- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2025-10263
An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.
- Record
EUVD-2025-10263- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5xm9-x7x4-4j5x
Elasticsearch Vulnerable to Stack Overflow due to a Large Recursion
An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.
- Record
GHSA-5xm9-x7x4-4j5x- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.
- Record
CVE-2024-52981- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.
- Record
CVE-2024-52981- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-5xm9-x7x4-4j5x
Elasticsearch Vulnerable to Stack Overflow due to a Large Recursion
An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.
- Record
GHSA-5xm9-x7x4-4j5x- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-52981
An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.
- Record
UBUNTU-CVE-2024-52981- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-elasticsearch-2024-52981 No score
An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.
- Record
BIT-elasticsearch-2024-52981- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.elasticsearch:elasticsearchMaven |
7.17.0 to 7.17.23 | 7.17.24 |
org.elasticsearch:elasticsearchMaven |
8.0.0-alpha1 to 8.15.0 | 8.15.1 |
elasticsearchBitnami |
7.17.0 up to 7.17.24, 8.0.0 up to 8.15.1 | 7.17.248.15.1 |
org.elasticsearch:elasticsearchMaven |
7.17.0 up to 7.17.24, plus listed versions 7.17.17.17.107.17.117.17.127.17.13 Show 18 moreShow less7.17.147.17.157.17.167.17.177.17.187.17.197.17.27.17.207.17.217.17.227.17.237.17.37.17.47.17.57.17.67.17.77.17.87.17.9 |
7.17.24 |
org.elasticsearch:elasticsearchMaven |
8.0.0-alpha1 up to 8.15.1, plus listed versions 8.0.08.0.0-alpha28.0.0-beta18.0.0-rc18.0.0-rc2 Show 45 moreShow less8.0.18.1.08.1.18.1.28.1.38.10.08.10.18.10.28.10.38.10.48.11.08.11.18.11.28.11.38.11.48.12.08.12.18.12.28.13.08.13.18.13.28.13.38.13.48.14.08.14.18.14.28.14.38.15.08.2.08.2.18.2.28.2.38.3.08.3.18.3.28.3.38.4.08.4.18.4.28.4.38.5.08.5.18.5.28.5.38.6.0 |
8.15.1 |
elasticsearchUbuntu:16.04:LTS |
All versions, plus listed versions 1.6.2+dfsg-11.7.3+dfsg-11.7.3+dfsg-21.7.3+dfsg-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-52981 is a medium vulnerability (CVSS 4.9) in Elastic Elasticsearch, published April 8, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.59%, the 48th percentile. Fixed in org.elasticsearch:elasticsearch 7.17.24.
References
discuss.elastic.co/t/elasticsearch-7-17-24-and-8-15-1-security-update-esa-2024-37/376924
nvd.nist.gov/vuln/detail/CVE-2024-52981
github.com/elastic/elasticsearch/commit/097fc0654f9305e01402a06c82926bb04ebe5495
Left out here: 10 versions. The JSON record has them.