CVE-2024-52979
Elasticsearch Uncontrolled Resource Consumption vulnerability
Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Elasticsearch Uncontrolled Resource Consumption vulnerability
Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.
- Record
CVE-2024-52979- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2025-13053
Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.
- Record
EUVD-2025-13053- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-mm3m-5497-xggg
Elasticsearch Uncontrolled Resource Consumption Vulnerability
Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.
- Record
GHSA-mm3m-5497-xggg- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.
- Record
CVE-2024-52979- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
Elasticsearch Uncontrolled Resource Consumption vulnerability
Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.
- Record
CVE-2024-52979- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-mm3m-5497-xggg
Elasticsearch Uncontrolled Resource Consumption Vulnerability
Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.
- Record
GHSA-mm3m-5497-xggg- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2024-52979
Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.
- Record
UBUNTU-CVE-2024-52979- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-elasticsearch-2024-52979 No score
Elasticsearch Uncontrolled Resource Consumption vulnerability
Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.
- Record
BIT-elasticsearch-2024-52979- Updated
- 2026-11-02
OSVCLSA-2026-1792654461 No score
TuxCare security update for org.elasticsearch:elasticsearch (3 CVEs)
TuxCare rebuilt org.elasticsearch:elasticsearch to address 3 CVEs. Fixed in 7.17.15-tuxcare.1.
- Record
CLSA-2026-1792654461- Updated
- 2026-11-02
OSVCLSA-2026-1792688503 No score
TuxCare security update for org.elasticsearch:elasticsearch (3 CVEs)
TuxCare rebuilt org.elasticsearch:elasticsearch to address 3 CVEs. Fixed in 7.16.3-tuxcare.2.
- Record
CLSA-2026-1792688503- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.elasticsearch:elasticsearchMaven |
before 7.17.25 | 7.17.25 |
org.elasticsearch:elasticsearchMaven |
8.0.0-alpha1 up to 8.16.0 | 8.16.0 |
elasticsearchBitnami |
7.17.0 up to 7.17.25, 8.0.0 up to 8.16.0 | 7.17.258.16.0 |
org.elasticsearch:elasticsearchTuxCare:Maven From an advisory covering 3 CVEs |
7.17.15 up to 7.17.15-tuxcare.1 | 7.17.15-tuxcare.1 |
org.elasticsearch:elasticsearchTuxCare:Maven From an advisory covering 3 CVEs |
7.16.3 up to 7.16.3-tuxcare.2, plus listed versions 7.16.3-tuxcare.1 |
7.16.3-tuxcare.2 |
org.elasticsearch:elasticsearchMaven |
before 7.17.25, plus listed versions 0.10.00.11.00.12.00.12.10.13.0 Show 45 moreShow less0.13.10.14.00.14.10.14.20.14.30.14.40.15.00.15.10.15.20.16.00.16.10.16.20.16.30.16.40.16.50.17.00.17.10.17.100.17.20.17.30.17.40.17.50.17.60.17.70.17.80.17.90.18.00.18.10.18.20.18.30.18.40.18.50.18.60.18.70.19.00.19.0.RC10.19.0.RC20.19.0.RC30.19.10.19.100.19.110.19.120.19.20.19.30.19.4 |
7.17.25 |
org.elasticsearch:elasticsearchMaven |
8.0.0-alpha1 up to 8.16.0, plus listed versions 8.0.08.0.0-alpha28.0.0-beta18.0.0-rc18.0.0-rc2 Show 45 moreShow less8.0.18.1.08.1.18.1.28.1.38.10.08.10.18.10.28.10.38.10.48.11.08.11.18.11.28.11.38.11.48.12.08.12.18.12.28.13.08.13.18.13.28.13.38.13.48.14.08.14.18.14.28.14.38.15.08.15.18.15.28.15.38.15.48.15.58.2.08.2.18.2.28.2.38.3.08.3.18.3.28.3.38.4.08.4.18.4.28.4.3 |
8.16.0 |
elasticsearchUbuntu:16.04:LTS |
All versions, plus listed versions 1.6.2+dfsg-11.7.3+dfsg-11.7.3+dfsg-21.7.3+dfsg-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-52979 is a medium vulnerability (CVSS 6.5) in Elastic Elasticsearch, published May 1, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.66%, the 51st percentile. Fixed in org.elasticsearch:elasticsearch 7.17.25.
References
discuss.elastic.co/t/elasticsearch-7-17-25-and-8-16-0-security-update-esa-2024-40/377709
nvd.nist.gov/vuln/detail/CVE-2024-52979
github.com/elastic/elasticsearch/pull/114002
Left out here: 304 versions. The JSON record has them.