GHSA-5xm9-x7x4-4j5x

Source

https://github.com/advisories/GHSA-5xm9-x7x4-4j5x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-5xm9-x7x4-4j5x/GHSA-5xm9-x7x4-4j5x.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5xm9-x7x4-4j5x

Aliases

Downstream

MINI (2)

Published

2025-04-08T18:34:43Z

Modified

2025-05-27T18:12:57Z

Severity

4.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Elasticsearch Vulnerable to Stack Overflow due to a Large Recursion

Details

An issue was discovered in Elasticsearch, where a large recursion using the Well-KnownText formatted string with nested GeometryCollection objects could cause a stackoverflow.

Database specific

{
    "cwe_ids":  [
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-04-09T13:06:43Z",
    "nvd_published_at":  "2025-04-08T17:15:35Z",
    "severity":  "MODERATE"
}

References

Affected packages

Maven / org.elasticsearch:elasticsearch

Package

Name: org.elasticsearch:elasticsearch; View open source insights on deps.dev
Purl: pkg:maven/org.elasticsearch/elasticsearch

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.17.0

Fixed

7.17.24

Affected versions

7.*

7.17.0

7.17.1

7.17.2

7.17.3

7.17.4

7.17.5

7.17.6

7.17.7

7.17.8

7.17.9

7.17.10

7.17.11

7.17.12

7.17.13

7.17.14

7.17.15

7.17.16

7.17.17

7.17.18

7.17.19

7.17.20

7.17.21

7.17.22

7.17.23

Database specific

last_known_affected_version_range

"<= 7.17.23"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-5xm9-x7x4-4j5x/GHSA-5xm9-x7x4-4j5x.json"

Maven / org.elasticsearch:elasticsearch

Package

Name: org.elasticsearch:elasticsearch; View open source insights on deps.dev
Purl: pkg:maven/org.elasticsearch/elasticsearch

Affected ranges

Type: ECOSYSTEM
Events: Introduced

8.0.0-alpha1

Fixed

8.15.1

Affected versions

8.*

8.0.0-alpha1

8.0.0-alpha2

8.0.0-beta1

8.0.0-rc1

8.0.0-rc2

8.0.0

8.0.1

8.1.0

8.1.1

8.1.2

8.1.3

8.2.0

8.2.1

8.2.2

8.2.3

8.3.0

8.3.1

8.3.2

8.3.3

8.4.0

8.4.1

8.4.2

8.4.3

8.5.0

8.5.1

8.5.2

8.5.3

8.6.0

8.6.1

8.6.2

8.7.0

8.7.1

8.8.0

8.8.1

8.8.2

8.9.0

8.9.1

8.9.2

8.10.0

8.10.1

8.10.2

8.10.3

8.10.4

8.11.0

8.11.1

8.11.2

8.11.3

8.11.4

8.12.0

8.12.1

8.12.2

8.13.0

8.13.1

8.13.2

8.13.3

8.13.4

8.14.0

8.14.1

8.14.2

8.14.3

8.15.0

Database specific

last_known_affected_version_range

"<= 8.15.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/04/GHSA-5xm9-x7x4-4j5x/GHSA-5xm9-x7x4-4j5x.json"