CVE-2024-52980: elastic elasticsearch Uncontrolled Resource Consumption
CVSS: 6.5v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2024-52980CGA-35wq-xq46-3phrCGA-37g4-gg98-6c2xCGA-4f3m-34f4-xx9rCGA-5w4x-67v5-qj5jCGA-6r5v-vv68-5p5vCGA-95pv-7vxv-p7v2CGA-cjx5-5vgp-5w95CGA-f6mv-gpmv-8m96CGA-gf52-qvgj-4f48CGA-j665-349w-2p95CGA-jjqp-22c2-4w94CGA-mjv2-cwg4-v6m5CGA-pjcg-g395-cp55GHSA-ghfh-p92w-j4mgBIT-elasticsearch-2024-52980CGA-q2cj-rv36-2cgfCGA-qc46-mp45-7rx5CGA-rj9x-f36w-jr4gCGA-wgj7-vhxw-cf3vCGA-wj57-7xh5-j4p9CGA-x3v5-m5p6-whh8CGA-x5vj-qh85-pwq8CGA-xwg6-hvhw-x5w5CGA-xwh9-h6cj-6p8h
Published 08-04-2025Last modified 08-04-2025
Vulnerability summary
CVE-2024-52980 is a medium (CVSS 6.5) Uncontrolled Resource Consumption vulnerability in elastic elasticsearch. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 44.6% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)EPSS score
0.55%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 08-04-2025PublishedVulnerability first disclosed.
- 08-04-2025Last modifiedVulnerability information updated.
Description
A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash. A successful attack requires a malicious user to have read_pipeline Elasticsearch cluster privilege assigned to them.
CVSS metrics
5 scores · 5 sources · 1 versionMedium 6.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- OSV · MavenEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.55%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
+0.01 pp
From 0.54% on 19-09-2026
19-09-202619-10-2026
EPSS score0.55%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard9 products
- camunda-8.8< 8.8.39-r1
- camunda-zeebe-8.6< 8.6.39-r13
- camunda-zeebe-8.7< 8.7.41-r1
- camunda-zeebe-8.8< 8.8.39-r1
- conductor< 3.31.0-r4
Elastic1 product
- elasticsearch≥ 7.17.0, ≤ 8.15.0 | ≥ 7.17.0, < 8.15.1
Org.elasticsearch1 product
- elasticsearch-grok≥ 7.17.0, < 8.15.1
Ubuntu1 product
- elasticsearchAll versions (No fix recorded)
4 vendors · 12 products
References
8 links- discuss.elastic.co/t/elasticsearch-8-15-1-security-update-esa-2024-34/376919REPORTWEBIssue TrackingPatchVendor Advisory
