CVE-2024-37280: 
Java vulnerability analysis and mitigation

A flaw was discovered in Elasticsearch, affecting document ingestion when an index template contains a dynamic field mapping of "passthrough" type. Under certain circumstances, ingesting documents in this index would cause a StackOverflow exception to be thrown and ultimately lead to a Denial of Service. The vulnerability affects Elasticsearch versions 8.13.1 through 8.13.4, and was disclosed on June 13, 2024. Note that passthrough fields is an experimental feature (Elastic Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 4.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H. This indicates that the vulnerability requires network access and high privileges to exploit, but no user interaction is needed. The vulnerability has been classified under CWE-787 (Out-of-bounds Write) and CWE-122 (Heap-based Buffer Overflow) (NVD).

When successfully exploited, this vulnerability can lead to a Denial of Service (DoS) condition in the affected Elasticsearch system. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system (Elastic Advisory).

The vulnerability requires network access and high privileges to exploit. It specifically occurs when an index template contains a dynamic field mapping of "passthrough" type, and under certain circumstances during document ingestion (NVD).

The vulnerability has been patched in Elasticsearch version 8.14.0. Users are advised to upgrade to this version to mitigate the risk (Elastic Advisory).