{"id":"CVE-2024-37281","summary":"Kibana Denial of Service issue","details":"An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific endpoint.","aliases":["BIT-elk-2024-37281","BIT-kibana-2024-37281"],"modified":"2026-08-12T15:15:18.123904Z","published":"2024-07-30T21:45:36.488Z","database_specific":{"cna_assigner":"elastic","cwe_ids":["CWE-400"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37281.json","unresolved_ranges":[{"extracted_events":[{"introduced":"7.x"},{"fixed":"7.17.23"},{"introduced":"8.x"},{"fixed":"8.14.0"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://discuss.elastic.co/t/kibana-7-17-23-8-14-0-security-update-esa-2024-16/364094"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37281.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-37281"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/elasticsearch","events":[{"introduced":"b7e28a7232616c7a21bc879a535d801b8553ba77"},{"fixed":"61d76462eecaf09ada684d1b5d319b5ff6865a83"},{"introduced":"1b6a7ece17463df5ff54a3e1302d825889aa1161"},{"fixed":"8d96bbe3bf5fed931f3119733895458eab75dca9"}],"database_specific":{"cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"7.0.0"},{"fixed":"7.17.23"},{"introduced":"8.0.0"},{"fixed":"8.14.0"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-37281.json","vanir_signatures_modified":"2026-08-12T15:15:18Z","vanir_signatures":[{"digest":{"function_hash":"69844453905830246677820397096534298013","length":935},"id":"CVE-2024-37281-3fa86dc6","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/61d76462eecaf09ada684d1b5d319b5ff6865a83","target":{"file":"qa/os/src/test/java/org/elasticsearch/packaging/test/DockerTests.java","function":"test600Interrupt"},"deprecated":false},{"digest":{"line_hashes":["268439700297186282373755313812072452487","26797522030344409565822344236984547088","49674375891833826585064844018322645796","241861009769944274883436754269135918658","110241150124042836880806124194125742521","4974205076996931494879974579405987532"],"threshold":0.9},"id":"CVE-2024-37281-bda6ba2f","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/61d76462eecaf09ada684d1b5d319b5ff6865a83","target":{"file":"qa/os/src/test/java/org/elasticsearch/packaging/test/DockerTests.java"},"deprecated":false}]}},{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/kibana","events":[{"introduced":"ee89fda8a17eff9c93f7400c102edf76cb4d7d8a"},{"fixed":"89cafc519e1d6e0e08d8cf5c13eee6886fe6e412"},{"introduced":"57ca5e139a33dd2eed927ce98d8231a1f217cd15"},{"fixed":"3bc2979d1d65982aee7d13ebd65434c3470dc808"}],"database_specific":{"cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"7.0.0"},{"fixed":"7.17.23"},{"introduced":"8.0.0"},{"fixed":"8.14.0"}],"source":"CPE_RANGE"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-37281.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}