CVE-2024-52979

What it actually does

Uncontrolled resource consumption occurs when Elasticsearch evaluates specially crafted search templates containing Mustache functions, exhausting node resources until the process crashes.

Why it matters to the business

Search and indexing operations become unavailable when nodes crash, interrupting dependent applications and data access across the environment until affected nodes are restarted or replaced.

How an attack unfolds

An attacker submits a malicious search template that abuses Mustache function evaluation to trigger excessive resource allocation inside the Elasticsearch process, causing the node to terminate and disrupting cluster availability.

How to fix it

Upgrade Elasticsearch to the fixed commit f9b6b57d1d0f76e2d14291c04fb50abeb642cfbf or later; for the listed Chainguard and Wolfi packages, deploy secrets-store-csi-driver-provider-aws version 1.0.1-r1 or newer.

How to confirm the fix worked

Confirm the running Elasticsearch version matches or exceeds the fixed commit, then verify that previously crashing templates no longer cause node termination under load testing.

Typical attack path

1. Locate an exposed or reachable Elasticsearch endpoint
2. Craft a search template containing abusive Mustache expressions
3. Submit the template through the search or render template API
4. Repeat submissions to exhaust resources and crash the node

How to detect it

Review Elasticsearch slow logs, audit logs, and node crash reports for repeated or unusually complex search template evaluations that coincide with OutOfMemory or crash events.

What your security team should do

• Apply the listed fixed versions immediately to all Elasticsearch instances
• Restrict search template creation and execution privileges to trusted roles only
• Monitor cluster health and node restarts for sudden unavailability patterns