Elasticsearch Uncontrolled Resource Consumption Vulnerability Allowing Denial-of-Service

A denial-of-service vulnerability has been identified in Elasticsearch versions 7.17.0 prior to 8.15.0. The issue arises from excessive recursion in the 'innerForbidCircularReferences' function of the 'PatternBank' class, which can lead to crashes of the Elasticsearch node. Exploitation of this vulnerability requires a malicious user to have the 'read_pipeline' privilege on the Elasticsearch cluster.

Impact

Exploitation of this vulnerability can cause the Elasticsearch node to crash, leading to a denial-of-service condition.

Remediation

Users should upgrade to Elasticsearch version 8.15.1 or higher. For those unable to upgrade, remove the 'read_pipeline' privilege from affected users.