CVE-2023-46673

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-11-22 · updated 2026-06-17
Weakness: CWE-755

Description

It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.

Affected products

Elasticsearch: from 7.0.0 before 7.17.14; from 8.0.0 before 8.10.3 — fixed in 7.17.14, 8.10.3

How to fix

Upgrade to a fixed version: Elasticsearch 7.17.14, 8.10.3. Check the vendor advisory for mitigations.

References

https://discuss.elastic.co/t/elasticsearch-7-17-14-8-10-3-security-update-esa-2023-24/347708
https://www.elastic.co/community/security
https://discuss.elastic.co/t/elasticsearch-7-17-14-8-10-3-security-update-esa-2023-24/347708
https://www.elastic.co/community/security

Get alerted when CVE-2023-46673 or the next vulnerability affects your stack