Elastic Kibana’s Fleet component allocates system resources without limits or throttling, a defect identified as CWE-770. A specially crafted request triggers redundant processing operations that relentlessly consume CPU, memory, or disk I/O until the service becomes degraded or unavailable. This denial of service condition can affect all users of an impacted Kibana instance, compromising availability but not directly exposing data.

The vulnerability affects the Elastic Kibana product. All versions that include the Fleet feature and have not yet applied the 8.19.10.9.1/8.19.10.9.2.4 security update are potentially vulnerable. Specific version numbers are not listed, so administrators should verify whether their Kibana release contains the Fleet component and apply the latest update.

The CVSS score of 6.5 indicates a moderate severity rating. The EPSS score is less than 1%, suggesting a low but nonzero likelihood of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker can trigger the flaw by sending a specially crafted request to the Kibana Fleet endpoint over the network; no privileged access is required, though the attacker must be able to reach the Kibana service.