{"id":"CVE-2024-52980","aliases":["GHSA-ghfh-p92w-j4mg"],"title":"Elasticsearch-grok Potential Node Crash due to Large Recursion in `innerForbidCircularReferences` Function","summary":"Elasticsearch-grok Potential Node Crash due to Large Recursion in `innerForbidCircularReferences` Function","severity":"medium","cvss":6.5,"cwe":["CWE-400"],"vendor":"elasticsearch","product":"org.elasticsearch:elasticsearch-grok","ecosystem":"maven","affected":["org.elasticsearch:elasticsearch-grok >= 7.17.0, < 8.15.1"],"patched":["org.elasticsearch:elasticsearch-grok 8.15.1"],"published":"2025-04-08","updated":"2026-09-25","sourceUpdated":"2026-09-25T17:29:47Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-ghfh-p92w-j4mg","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-52980"},{"url":"https://discuss.elastic.co/t/elasticsearch-8-15-1-security-update-esa-2024-34/376919"},{"url":"https://github.com/elastic/elasticsearch/commit/4e5c6801f4d60f100f122072f6bf35b21fd722a5"},{"url":"https://github.com/elastic/elasticsearch/commit/a02dc7165c75f12701f8d47a2bdefe5283735267"},{"url":"https://github.com/advisories/GHSA-ghfh-p92w-j4mg"}],"tags":["ghsa","maven"],"epss":0.00537,"epssPercentile":0.42777,"ingestedAt":"2026-09-25T18:14:20.398Z","slug":"CVE-2024-52980","body":"## Overview\n\nA flaw was discovered in Elasticsearch, where a large recursion using the innerForbidCircularReferences function of the PatternBank class could cause the Elasticsearch node to crash.\n\nA successful attack requires a malicious user to have read_pipeline Elasticsearch cluster privilege assigned to them.\n\n## Affected packages\n\n- `org.elasticsearch:elasticsearch-grok >= 7.17.0, < 8.15.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `org.elasticsearch:elasticsearch-grok 8.15.1`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}