Elasticsearch Uncontrolled Resource Consumption vulnerability (ESA-2024-37)
An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.
Affected Versions:
Elasticsearch versions 7.17.0 to 7.17.23 and 8.0 to 8.15.0.
Solutions and Mitigations:
Users should upgrade to version 7.17.24 or higher, or version 8.15.1 or higher.
Severity: CVSS v3.1: 4.9 (Medium) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/CR:M/IR:M/AR:M
CVE ID: CVE-2024-52981
2025-04-25 Update: added version 7.17.24 to solutions and mitigations