How severe is CVE-2024-23449?

CVE-2024-23449 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2024-23449 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-23449?

CVE-2024-23449 affects Elastic Elasticsearch. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-23449?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-23449 have an EU (EUVD) identifier?

Yes. CVE-2024-23449 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-0982.

When was CVE-2024-23449 published?

CVE-2024-23449 was published on 2024-03-29 and last updated on 2026-06-17.

CVE-2024-23449

CVE-2024-23449 is a medium-severity vulnerability in Elastic Elasticsearch with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-248.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
EPSS exploit prediction: 1% (51st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-0982
Weakness: CWE-248
Affected product: Elastic Elasticsearch
Published: 2024-03-29
Last modified: 2026-06-17

Description

An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.

Frequently asked questions

What is CVE-2024-23449?: An uncaught exception in Elasticsearch >= 8.4.0 and < 8.11.1 occurs when an encrypted PDF is passed to an attachment processor through the REST API. The Elasticsearch ingest node that attempts to parse the PDF file will crash. This does not happen with password-protected PDF files or with unencrypted PDF files.
How severe is CVE-2024-23449?: CVE-2024-23449 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2024-23449 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-23449?: CVE-2024-23449 affects Elastic Elasticsearch. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-23449?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-23449 have an EU (EUVD) identifier?: Yes. CVE-2024-23449 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-0982.
When was CVE-2024-23449 published?: CVE-2024-23449 was published on 2024-03-29 and last updated on 2026-06-17.

References

https://discuss.elastic.co/t/elasticsearch-8-11-1-security-update-esa-2024-05/356458

Affected products (1)

cpe:2.3:a:elastic:elasticsearch:*:*:*:*:*:*:*:*

More vulnerabilities in Elastic Elasticsearch

CVE-2015-5377 — Critical (CVSS 9.8): Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the…
CVE-2015-1427 — Critical (CVSS 9.8): The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the…
CVE-2026-72649 — High (CVSS 8.8): Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code…
CVE-2026-72642 — High (CVSS 8.8): The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model…
CVE-2020-7014 — High (CVSS 8.8): The fix for CVE-2020-7009 was found to be incomplete. Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1…
CVE-2020-7009 — High (CVSS 8.8): Elasticsearch versions from 6.7.0 before 6.8.8 and 7.0.0 before 7.6.2 contain a privilege escalation flaw if an…

All CVEs affecting Elastic Elasticsearch →

Other CWE-248 vulnerabilities

CVE-2018-11466 — Critical (CVSS 9.8): A vulnerability has been identified in SINUMERIK 808D V4.7 (All versions), SINUMERIK 808D V4.8 (All versions),…
CVE-2024-42037 — Critical (CVSS 9.3): Vulnerability of uncaught exceptions in the Graphics module Impact: Successful exploitation of this vulnerability may…
CVE-2025-53620 — Critical (CVSS 9.2): @builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the…
CVE-2026-61666 — High (CVSS 8.9): websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server() passes…
CVE-2026-96277 — High (CVSS 8.7): Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift Ruby bindings. This…
CVE-2026-96294 — High (CVSS 8.7): Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This…

Browse all CWE-248 vulnerabilities →

Threat intelligence

Threat-intel indicators referencing this CVE:

138.3.223.188 (ipv4-addr)
51.12.221.15 (ipv4-addr)