What is GHSA-pw39-f3m5-cxfc?

GHSA-pw39-f3m5-cxfc is a security advisory published by GitHub Security Advisories with Medium severity. Elasticsearch Uncaught Exception leading to crash

Which CVE IDs does GHSA-pw39-f3m5-cxfc cover?

GHSA-pw39-f3m5-cxfc covers the following CVE IDs: CVE-2024-23449. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pw39-f3m5-cxfc?

GHSA-pw39-f3m5-cxfc has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-pw39-f3m5-cxfc?

GHSA-pw39-f3m5-cxfc affects 1 product, including: maven/org.elasticsearch:elasticsearch:\u003e= 8.4.0, \u003c 8.11.1.

GHSA-pw39-f3m5-cxfcMediumCVSS 4.3

Elasticsearch Uncaught Exception leading to crash

Vendor

GitHub Security Advisories

Published

March 29, 2024

Last Modified

May 27, 2025

🔗 CVE IDs covered (1)

CVE-2024-23449 →

📋 Description

An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.

🎯 Affected products1

maven/org.elasticsearch:elasticsearch:>= 8.4.0, < 8.11.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2024-23449
https://discuss.elastic.co/t/elasticsearch-8-11-1-security-update-esa-2024-05/356458
https://github.com/elastic/elasticsearch/commit/a59180459a3cb30b71399d778943cab4ac2191c4
https://github.com/elastic/elasticsearch/commit/f9bf18a716613473fc1cb96c838874e1f9f6ba22
https://github.com/advisories/GHSA-pw39-f3m5-cxfc