CVE-2024-52979

7.5 highEPSS 0.6%

High (7.5) in elastic elasticsearch. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in org.elasticsearch:elasticsearch 7.17.25, 8.16.0.

Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 51% of CVEs (scores of 2026-10-31)
CWE: CWE-400
Published: 2025-05-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

elastic:elasticsearch

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-mm3m-5497-xggg	Maven	org.elasticsearch:elasticsearch	<7.17.25	7.17.25
GHSA-mm3m-5497-xggg	Maven	org.elasticsearch:elasticsearch	>=8.0.0-alpha1 <8.16.0	8.16.0

References

https://discuss.elastic.co/t/elasticsearch-7-17-25-and-8-16-0-security-update-esa-2024-40/377709

Check your stack JSON