CVE-2024-37280

What it actually does

Ingestion of documents against an index template using an experimental dynamic 'passthrough' field mapping triggers an unbounded recursion that throws a StackOverflowError, crashing the ingest thread and rendering the node unavailable for further indexing or search operations.

Why it matters to the business

Elasticsearch clusters become intermittently or fully unavailable for data ingestion and queries, disrupting log analytics, observability, and search workloads until the affected node is restarted or the cluster is scaled.

How an attack unfolds

An attacker with index privileges creates or modifies an index template containing a passthrough dynamic mapping, then submits specially crafted documents that exercise the mapping path; the resulting recursion exhausts the stack and produces a denial of service.

How to fix it

Upgrade Elasticsearch to a build containing commit 8d96bbe3bf5fed931f3119733895458eab75dca9 or a later release that disables or corrects the passthrough mapping recursion; until patched, avoid using passthrough mappings in any index templates.

How to confirm the fix worked

Confirm the running Elasticsearch version includes commit 8d96bbe3bf5fed931f3119733895458eab75dca9; attempt document ingestion against a test index template that uses a passthrough mapping and verify no StackOverflowError occurs.

Typical attack path

1. Obtain privileges sufficient to manage index templates and ingest documents
2. Create or update an index template that declares a dynamic field of type passthrough
3. Submit document batches that trigger the passthrough mapping logic during ingestion
4. Observe StackOverflowError in logs and subsequent node or cluster unavailability

How to detect it

Search Elasticsearch and application logs for repeated StackOverflowError exceptions occurring during document ingestion or template application; correlate with spikes in failed bulk indexing requests.

• StackOverflowError
• passthrough
• dynamic field mapping

What your security team should do

• Immediately upgrade all Elasticsearch instances to a build containing the referenced fix commit
• Audit existing index templates and remove any experimental passthrough dynamic mappings
• Implement ingest pipeline validation rules that reject templates containing passthrough fields until the patch is deployed
• Monitor for StackOverflowError events in Elasticsearch logs as a temporary detection control