Executive brief
Elasticsearch is a widely-used search and analytics engine. An authenticated attacker with pipeline-read permissions can trigger excessive recursion in the grok pattern validation logic, causing an Elasticsearch node to crash and disrupt service availability. The attack requires legitimate cluster access but no administrative privileges.
Technical details
A resource exhaustion vulnerability exists in the PatternBank class's innerForbidCircularReferences function, which performs recursive validation of grok patterns. An attacker with read_pipeline cluster privilege can craft a malicious grok pattern with deeply nested structure to trigger uncontrolled recursion, leading to stack overflow and node crash (CWE-400: Uncontrolled Resource Consumption). The attack is network-reachable and requires only low-privilege authentication; no user interaction is needed. Elasticsearch versions 7.17.0 through 8.15.0 are affected; the fix is available in version 8.15.1 and later.
Affected products
- Elastic Elasticsearch 7.17.0 to 8.15.0
Timeline
- 2025-04-08: disclosed
- 8.15.1: patched: Version 8.15.1 and later contain the fix