Elasticsearch Uncontrolled Resource Consumption vulnerability (Elastic Elasticsearch)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.65 % · percentile 51 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- elastic
- NVD status
- Analyzed
Description
Uncontrolled Resource Consumption in Elasticsearch while evaluating specifically crafted search templates with Mustache functions can lead to Denial of Service by causing the Elasticsearch node to crash.
Weaknesses (CWE)
- CWE-400 — Uncontrolled Resource Consumption
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | elastic |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · security@elastic.co (Secondary) |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-mm3m-5497-xggg — Elasticsearch Uncontrolled Resource Consumption Vulnerability
European references
- ENISA EUVD · EUVD-2025-13053
- GCVE · GCVE-0-2024-52979
CERT-FR advisories
- CERTFR-2025-AVI-0661 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0359 — Multiples vulnérabilités dans les produits Elastic · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*< 7.17.25cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.16.0
Affected products
| Product | Versions |
|---|---|
| Elastic · Elasticsearch | affected 7.17.0 < 7.17.25 ; affected 8.0.0 < 8.16.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |