Improper validation of a specified quantity in user input (CWE‑1284) allows an authenticated user with view‑only access to send a specially crafted payload that consumes excessive resources, causing Kibana to become unresponsive or crash. The vulnerability arises from accepting malformed input without correctly limiting the amount of data processed, leading to denial of service.

Elastic Kibana instances are affected. The vulnerability applies to all released versions of Kibana, including the latest security releases up to 9.3.0 and earlier. Administrators should verify that their deployment falls within the affected range and apply the corresponding updates.

With a CVSS score of 6.5, the vulnerability is considered moderate. The EPSS score of less than 1% indicates a low likelihood of exploitation at this time, and it is not currently listed in CISA’s KEV catalog. Nevertheless, an authenticated attacker with view‑only privileges can trigger the denial of service by submitting the malicious payload. The attack vector is internal or remote, depending on network exposure, but requires valid Kibana authentication and appropriate permissions. The impact is service interruption for all users of the affected Kibana instance.