CVE-2024-43709

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-43709
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-43709.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-43709
Aliases
Downstream
Published
2025-01-21T11:00:11.403Z
Modified
2026-05-28T04:09:59.453782792Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Elasticsearch allocation of resources without limits or throttling leads to crash
Details

An allocation of resources without limits or throttling in Elasticsearch can lead to an OutOfMemoryError exception resulting in a crash via a specially crafted query using an SQL function.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "7.17.0, 8.0.0"
                },
                {
                    "fixed": "7.17.21, 8.13.3"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/43xxx/CVE-2024-43709.json",
    "cwe_ids": [
        "CWE-770"
    ],
    "cna_assigner": "elastic"
}
References

Affected packages

Git / github.com/elastic/elasticsearch

Affected ranges

Type
GIT
Repo
https://github.com/elastic/elasticsearch
Events
Introduced
bee86328705acaa9a6daede7140defd4d9ec56bd
Fixed
d38e4b028f4a9784bb74de339ac1b877e2dbea6f
Introduced
1b6a7ece17463df5ff54a3e1302d825889aa1161
Fixed
617f7b76c4ebcb5a7f1e70d409a99c437c896aea
Database specific 
{
    "extracted_events": [
        {
            "introduced": "7.17.0"
        },
        {
            "fixed": "7.17.21"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "fixed": "8.13.3"
        }
    ],
    "cpe": "cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE"
}

Affected versions

v7.*
v7.17.0
v7.17.1
v7.17.10
v7.17.11
v7.17.12
v7.17.13
v7.17.14
v7.17.15
v7.17.16
v7.17.17
v7.17.18
v7.17.19
v7.17.2
v7.17.20
v7.17.3
v7.17.4
v7.17.5
v7.17.6
v7.17.7
v7.17.8
v7.17.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-43709.json"