Elasticsearch 8.18.4 has uncontrolled recursion CVE

Elastic Stack Elasticsearch
,
1

Hey team, we're looking at ES 8.18.4 and getting an issues with an uncontrolled recursion vulnerability from Snyk. Can anyone tell me if this is already in the works, or a ticket I can link to for my team?

Testing docker.elastic.co/elasticsearch/elasticsearch:8.18.4...

Tested 8 dependencies for known issues, found 1 issue.

Issues to fix by upgrading:

Upgrade org.apache.commons:commons-lang3@3.9 to org.apache.commons:commons-lang3@3.18.0 to fix
✗ Uncontrolled Recursion (new) [High Severity][Uncontrolled Recursion in org.apache.commons:commons-lang3 | CVE-2025-48924 | Snyk] in org.apache.commons:commons-lang3@3.9
introduced by org.apache.commons:commons-lang3@3.9

2

We can't discuss security vulnerabilities in public channels such as this forum, sorry. Please follow these instructions about reporting potential security vulnerabilities instead. Note that a published vulnerability in a dependency does not indicate whether Elasticsearch itself has a similar vulnerability. It may be that Elasticsearch uses the dependency in a way that prevents the issue from occurring.

1 Like