CVE-2024-52980: Elastic Elasticsearch denial of service via grok pattern recursion

CVE-2024-52980 · Severity: medium · CVSS 6.5 · Published 2025-04-08

Elasticsearch is a widely-used search and analytics engine. An authenticated attacker with pipeline-read permissions can trigger excessive recursion in the grok pattern validation logic, causing an Elasticsearch node to crash and disrupt service availability. The attack requires legitimate cluster access but no administrative privileges.

Technologies: Elasticsearch. Vendors: Elastic, Maven.

Quick answers

Is CVE-2024-52980 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-52980 being exploited in the wild.
How severe is CVE-2024-52980?
Medium severity, with a CVSS score of 6.5, published 8 April 2025.
Which products and versions are affected?
Elasticsearch 7.17.0 to 8.15.0; org.elasticsearch:elasticsearch-grok (Maven) >= 7.17.0, < 8.15.1, ECOSYSTEM:introduced=7.17.0,fixed=8.15.1.
Is there a fix for CVE-2024-52980?
Yes. org.elasticsearch:elasticsearch-grok (Maven): upgrade to 8.15.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-52980 attacked?
It is attacked over the network.
Am I affected by CVE-2024-52980?
Check whether you run Elasticsearch or org.elasticsearch:elasticsearch-grok (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.elasticsearch:elasticsearch-grok (Maven): upgrade to 8.15.1 or later
    # set org.elasticsearch:elasticsearch-grok to 8.15.1 in your pom.xml or build.gradle

Technical details

A resource exhaustion vulnerability exists in the PatternBank class's innerForbidCircularReferences function, which performs recursive validation of grok patterns. An attacker with read_pipeline cluster privilege can craft a malicious grok pattern with deeply nested structure to trigger uncontrolled recursion, leading to stack overflow and node crash (CWE-400: Uncontrolled Resource Consumption). The attack is network-reachable and requires only low-privilege authentication; no user interaction is needed. Elasticsearch versions 7.17.0 through 8.15.0 are affected; the fix is available in version 8.15.1 and later.

Affected products

  • Elastic Elasticsearch 7.17.0 to 8.15.0

Identifiers

  • CVE-2024-52980
  • GHSA-ghfh-p92w-j4mg

Timeline

  • 2025-04-08: disclosed
  • 8.15.1: patched: Version 8.15.1 and later contain the fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.