CVE-2024-23450

What it actually does

Processing a document containing excessive nesting depth through an ingest pipeline causes the Elasticsearch ingest node to terminate unexpectedly due to unhandled resource exhaustion or recursion limits.

Why it matters to the business

Adversaries with administrative ingest privileges can trigger repeated node crashes, resulting in indexing and search outages that disrupt data ingestion pipelines and dependent applications.

How an attack unfolds

An attacker with high-privileged access crafts a document with extreme nesting levels and submits it to an ingest pipeline on an Elasticsearch node; the node processes the document without sufficient depth validation and crashes, requiring manual restart.

How to fix it

Upgrade Elasticsearch to a build containing commit 09df99393193b2c53d92899662a8b8b3c55b45cd or later; disable or restrict ingest pipelines from untrusted sources until patched.

How to confirm the fix worked

Verify the running version includes the referenced commit, then attempt ingestion of a test document with controlled high nesting depth to confirm the node remains stable.

Typical attack path

1. Obtain high-privileged credentials or API access to an ingest node
2. Construct a document containing deeply nested objects or arrays
3. Submit the document to a pipeline configured on the ingest node
4. Observe node termination and repeat to sustain denial of service

How to detect it

Review Elasticsearch logs on ingest nodes for sudden terminations or stack traces occurring during pipeline document processing; correlate with API requests that trigger ingest operations.

What your security team should do

• Apply the fixed commit or subsequent release immediately on all ingest nodes
• Audit and restrict ingest pipeline permissions to the minimum required roles
• Implement resource limits and monitoring for ingest node stability