# CVE-2024-52980: Elastic Elasticsearch denial of service via grok pattern recursion

Source: https://junglewise.ai/threats/cve-2024-52980-elastic-elasticsearch-denial-of-service-via-grok-pattern  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-04-08. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2024-52980 · Severity: medium · CVSS 6.5 · Published 2025-04-08

Elasticsearch is a widely-used search and analytics engine. An authenticated attacker with pipeline-read permissions can trigger excessive recursion in the grok pattern validation logic, causing an Elasticsearch node to crash and disrupt service availability. The attack requires legitimate cluster access but no administrative privileges.

Technologies: [Elasticsearch](https://junglewise.ai/threats/technologies/elasticsearch). Vendors: [Elastic](https://junglewise.ai/threats/vendors/elastic), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2024-52980 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-52980 being exploited in the wild.

**How severe is CVE-2024-52980?** Medium severity, with a CVSS score of 6.5, published 8 April 2025.

**Which products and versions are affected?** Elasticsearch 7.17.0 to 8.15.0; org.elasticsearch:elasticsearch-grok (Maven) >= 7.17.0, < 8.15.1, ECOSYSTEM:introduced=7.17.0,fixed=8.15.1.

**Is there a fix for CVE-2024-52980?** Yes. org.elasticsearch:elasticsearch-grok (Maven): upgrade to 8.15.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-52980 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-52980?** Check whether you run Elasticsearch or org.elasticsearch:elasticsearch-grok (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.elasticsearch:elasticsearch-grok (Maven): upgrade to 8.15.1 or later

  ```sh
  # set org.elasticsearch:elasticsearch-grok to 8.15.1 in your pom.xml or build.gradle
  ```


## Technical details

A resource exhaustion vulnerability exists in the PatternBank class's innerForbidCircularReferences function, which performs recursive validation of grok patterns. An attacker with read_pipeline cluster privilege can craft a malicious grok pattern with deeply nested structure to trigger uncontrolled recursion, leading to stack overflow and node crash (CWE-400: Uncontrolled Resource Consumption). The attack is network-reachable and requires only low-privilege authentication; no user interaction is needed. Elasticsearch versions 7.17.0 through 8.15.0 are affected; the fix is available in version 8.15.1 and later.

## Affected products

- Elastic Elasticsearch 7.17.0 to 8.15.0

## Identifiers

- CVE-2024-52980
- GHSA-ghfh-p92w-j4mg

## Timeline

- 2025-04-08: disclosed
- 8.15.1: patched: Version 8.15.1 and later contain the fix

## References

- [https://api.github.com/users/AnonySE26](https://api.github.com/users/AnonySE26)

## Related threats

- [Elasticsearch denial of service in phonetic analysis encoders](https://junglewise.ai/threats/cve-2026-115715-allocation-of-resources-without-limits-or-throttling-cwe-770-in)
- [Elasticsearch cache information disclosure via field-level security bypass](https://junglewise.ai/threats/cve-2026-115710-use-of-cache-containing-sensitive-information-cwe-524-in)
- [Elasticsearch incorrect authorization in field-level security](https://junglewise.ai/threats/cve-2026-115298-incorrect-authorization-cwe-863-in-elasticsearch-can-lead-to)
- [Elasticsearch uncontrolled recursion denial of service](https://junglewise.ai/threats/cve-2026-115290-uncontrolled-recursion-cwe-674-in-elasticsearch-can-lead-to)
- [Elasticsearch authorization bypass in cross-cluster search](https://junglewise.ai/threats/cve-2026-103009-authorization-bypass-through-user-controlled-key-cwe-639-in)