{"schema":"threatline.record/2","record":{"id":"CVE-2024-52980","aliases":["BIT-elasticsearch-2024-52980","GHSA-ghfh-p92w-j4mg"],"summary":"Elasticsearch-grok Potential Node Crash due to Large Recursion in `innerForbidCircularReferences` Function","details":"A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash.\n\nA successful attack requires a malicious user to have read_pipeline Elasticsearch cluster privilege assigned to them.","categories":["Databases"],"product":"org.elasticsearch:elasticsearch-grok","vendor":"Elastic","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-ghfh-p92w-j4mg","source_modified_at":"2026-09-25T17:29:47Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.elasticsearch:elasticsearch-grok"},"range":">= 7.17.0, < 8.15.1"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2024-52980","source_modified_at":"2025-04-08T19:59:43.764Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Elasticsearch","vendor":"Elastic","versions":[{"lessThanOrEqual":"8.15.0","status":"affected","version":"7.17.0","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-ghfh-p92w-j4mg","source_modified_at":"2026-09-25T17:45:04.835167390Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"org.elasticsearch:elasticsearch-grok","ecosystem":"Maven","purl":"pkg:maven/org.elasticsearch/elasticsearch-grok"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.17.0"},{"fixed":"8.15.1"}]}],"versions":["8.10.0","8.10.1","8.10.2","8.10.3","8.10.4","8.11.0","8.11.1","8.11.2","8.11.3","8.11.4","8.12.0","8.12.1","8.12.2","8.13.0","8.13.1","8.13.2","8.13.3","8.13.4","8.14.0","8.14.1","8.14.2","8.14.3","8.15.0","8.5.0","8.5.1","8.5.2","8.5.3","8.6.0","8.6.1","8.6.2","8.7.0","8.7.1","8.8.0","8.8.1","8.8.2","8.9.0","8.9.1","8.9.2"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-ghfh-p92w-j4mg","source_modified_at":"2026-09-25T17:29:47Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"org.elasticsearch:elasticsearch-grok"},"version":"8.15.1"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-ghfh-p92w-j4mg","source_modified_at":"2026-09-25T17:45:04.835167390Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"org.elasticsearch:elasticsearch-grok","ecosystem":"Maven","purl":"pkg:maven/org.elasticsearch/elasticsearch-grok"},"version":"8.15.1"}],"cvss":6.5,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00547,"percentile":0.45058,"score_date":"2026-10-23"},"published_at":"2025-04-08T16:43:41.103Z","modified_at":"2026-09-25T17:45:04.835167390Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-ghfh-p92w-j4mg","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-25T17:29:47Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2024-52980","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2025-04-08T19:59:43.764Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-ghfh-p92w-j4mg","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-09-25T17:45:04.835167390Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2024-52980","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52980","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://discuss.elastic.co/t/elasticsearch-8-15-1-security-update-esa-2024-34/376919"},{"url":"https://github.com/elastic/elasticsearch/commit/4e5c6801f4d60f100f122072f6bf35b21fd722a5","source":"GitHub Advisory Database"},{"url":"https://github.com/elastic/elasticsearch/commit/a02dc7165c75f12701f8d47a2bdefe5283735267","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-ghfh-p92w-j4mg","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2025-04-08T19:59:32.130694Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-25T17:45:04.835167390Z","content_hash":"88339c13032faed0e68d938458e0c668c2c9a4ef62497c4244d1532ef0ad3f31"}}