CVE-2024-23449

—

CVSS 3.1

5.3 medium

EPSS

<1%p50

Published

Mar 29, 2024 (Mar 29, 2024)

Modified

Jun 17, 2026

Description

An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.

Vendors: elastic
Products: elasticsearch
Weakness: CWE-248
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.