Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-nq9p-8cfu-vkg4
Vulnerability ID VCID-nq9p-8cfu-vkg4
Aliases CVE-2024-23450
GHSA-w5gg-2q56-6h4f
Summary Elasticsearch Uncontrolled Resource Consumption vulnerability A flaw was discovered in Elasticsearch, where processing a document in a deeply nested pipeline on an ingest node could cause the Elasticsearch node to crash.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-400 Uncontrolled Resource Consumption
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 4.9 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-23450.json
epss 0.01064 https://api.first.org/data/v1/epss?cve=CVE-2024-23450
cvssv3.1 4.9 https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-19-security-update-esa-2024-06/356314
generic_textual MODERATE https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-19-security-update-esa-2024-06/356314
ssvc Track https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-19-security-update-esa-2024-06/356314
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-w5gg-2q56-6h4f
cvssv3.1 4.9 https://github.com/elastic/elasticsearch
generic_textual MODERATE https://github.com/elastic/elasticsearch
cvssv3.1 4.9 https://nvd.nist.gov/vuln/detail/CVE-2024-23450
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2024-23450
cvssv3.1 4.9 https://security.netapp.com/advisory/ntap-20240517-0010
generic_textual MODERATE https://security.netapp.com/advisory/ntap-20240517-0010
cvssv3.1 4.9 https://security.netapp.com/advisory/ntap-20240517-0010/
ssvc Track https://security.netapp.com/advisory/ntap-20240517-0010/
cvssv3.1 4.9 https://www.elastic.co/community/security
generic_textual MODERATE https://www.elastic.co/community/security
ssvc Track https://www.elastic.co/community/security
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-23450.json
https://api.first.org/data/v1/epss?cve=CVE-2024-23450
https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-19-security-update-esa-2024-06/356314
https://github.com/elastic/elasticsearch
https://security.netapp.com/advisory/ntap-20240517-0010
https://www.elastic.co/community/security
2271933 https://bugzilla.redhat.com/show_bug.cgi?id=2271933
CVE-2024-23450 https://nvd.nist.gov/vuln/detail/CVE-2024-23450
GHSA-w5gg-2q56-6h4f https://github.com/advisories/GHSA-w5gg-2q56-6h4f
ntap-20240517-0010 https://security.netapp.com/advisory/ntap-20240517-0010/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-23450.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Found at https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-19-security-update-esa-2024-06/356314
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-16T01:36:22Z/ Found at https://discuss.elastic.co/t/elasticsearch-8-13-0-7-17-19-security-update-esa-2024-06/356314
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/elastic/elasticsearch
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-23450
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Found at https://security.netapp.com/advisory/ntap-20240517-0010
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Found at https://security.netapp.com/advisory/ntap-20240517-0010/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-16T01:36:22Z/ Found at https://security.netapp.com/advisory/ntap-20240517-0010/
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Found at https://www.elastic.co/community/security
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-07-16T01:36:22Z/ Found at https://www.elastic.co/community/security
Exploit Prediction Scoring System (EPSS)
Percentile 0.77972
EPSS Score 0.01064
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T21:03:43.308005+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.elasticsearch/elasticsearch/CVE-2024-23450.yml 38.6.0