All vulnerabilities
CVE-2024-52980BIT-elasticsearch-2024-52980GHSA-ghfh-p92w-j4mg

org.elasticsearch:elasticsearch-grok: Elasticsearch-grok Potential Node Crash due to Large Recursion in `innerForbidCircularReferences` Function

Elastic org.elasticsearch:elasticsearch-grokmavenDatabases
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.55%Chance of exploitation activity in the next 30 days, higher than 45% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8.15.1Fixed versionGitHub
Published8 Apr 2025Updated 25 Sep 2026CVE List

What fixes it

  • 8.15.1org.elasticsearch:elasticsearch-grok, mavenGitHub<dependency><groupId>org.elasticsearch</groupId><artifactId>elasticsearch-grok</artifactId><version>8.15.1</version></dependency>
  • 8.15.1org.elasticsearch:elasticsearch-grok, MavenOSV<dependency><groupId>org.elasticsearch</groupId><artifactId>elasticsearch-grok</artifactId><version>8.15.1</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash.

A successful attack requires a malicious user to have read_pipeline Elasticsearch cluster privilege assigned to them.

Text from GitHub Advisory Database

Affected versions 41

  • org.elasticsearch:elasticsearch-grok, maven>= 7.17.0, < 8.15.1GitHub
  • Elasticsearchaffected: 7.17.0 through 8.15.0CVE List
  • org.elasticsearch:elasticsearch-grok, Mavenfrom 7.17.0, fixed in 8.15.1OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.10.0OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.10.1OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.10.2OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.10.3OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.10.4OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.11.0OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.11.1OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.11.2OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.11.3OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.11.4OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.12.0OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.12.1OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.12.2OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.13.0OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.13.1OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.13.2OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.13.3OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.13.4OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.14.0OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.14.1OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.14.2OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.14.3OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.15.0OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.5.0OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.5.1OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.5.2OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.5.3OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.6.0OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.6.1OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.6.2OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.7.0OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.7.1OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.8.0OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.8.1OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.8.2OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.9.0OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.9.1OSV
  • org.elasticsearch:elasticsearch-grok, Maven8.9.2OSV

References 5