What is GHSA-jgx4-7v3v-vwfm?

GHSA-jgx4-7v3v-vwfm is a security advisory published by GitHub Security Advisories with Medium severity. Elasticsearch allocation of resources without limits or throttling leads to crash

Which CVE IDs does GHSA-jgx4-7v3v-vwfm cover?

GHSA-jgx4-7v3v-vwfm covers the following CVE IDs: CVE-2024-43709. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-jgx4-7v3v-vwfm?

GHSA-jgx4-7v3v-vwfm has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-jgx4-7v3v-vwfm?

GHSA-jgx4-7v3v-vwfm affects 2 products, including: maven/org.elasticsearch:elasticsearch:\u003c 7.17.21; maven/org.elasticsearch:elasticsearch:\u003e= 8.0.0, \u003c 8.13.3.

GHSA-jgx4-7v3v-vwfmMediumCVSS 6.5

Elasticsearch allocation of resources without limits or throttling leads to crash

Vendor

GitHub Security Advisories

Published

January 21, 2025

Last Modified

February 21, 2025

🔗 CVE IDs covered (1)

CVE-2024-43709 →

📋 Description

An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.

🎯 Affected products2

maven/org.elasticsearch:elasticsearch:< 7.17.21
maven/org.elasticsearch:elasticsearch:>= 8.0.0, < 8.13.3

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-43709
https://discuss.elastic.co/t/elasticsearch-7-17-21-and-8-13-3-security-update-esa-2024-25/373442
https://security.netapp.com/advisory/ntap-20250221-0007
https://github.com/advisories/GHSA-jgx4-7v3v-vwfm