CVE-2024-52980: Elastic Elasticsearch

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

A flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash. A successful attack requires a malicious user to have read_pipeline Elasticsearch cluster privilege assigned to them.

Affected products

• Elastic Elasticsearch: from 7.17.0, before 8.15.1 (fixed in 8.15.1)

Published 2025-04-08. Last modified 2026-06-17.