CVE-2024-43709: 
Java vulnerability analysis and mitigation

An allocation of resources without limits or throttling vulnerability was discovered in Elasticsearch that can lead to an OutOfMemoryError exception and system crash when a specially crafted query using an SQL function is executed. The vulnerability is tracked as CVE-2024-43709 and affects Elasticsearch versions up to 7.17.21 and versions up to 8.13.3 (Elastic Discussion).

The vulnerability stems from improper resource allocation and throttling mechanisms in Elasticsearch's query processing system. When processing certain SQL function queries, the system fails to properly limit resource usage, which can be exploited to trigger an OutOfMemoryError exception. The vulnerability has been assigned a CVSSv3.1 score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (Elastic Discussion).

The successful exploitation of this vulnerability can result in a denial of service condition through system crashes caused by OutOfMemoryError exceptions. This can lead to service disruption and system unavailability (NVD).

The vulnerability has been patched in Elasticsearch versions 7.17.21 and 8.13.3. Users are strongly recommended to upgrade to these versions or later to address the security issue (Elastic Discussion).