Improper input validation in Kibana's internal Content Connectors search endpoint enables crafted requests to exploit a flaw in data handling, resulting in denial of service for the Kibana service. Classified as CWE‑20, the flaw can cause the target system to become unresponsive or crash, disrupting service availability for users and potentially impacting integrated dashboards or monitoring tools.

The vulnerability affects Elastic's Kibana product. All installations that expose the internal Content Connectors search endpoint are susceptible until patched. Versions of Kibana that include this endpoint, such as those listed in the CVE payload, are impacted.

The CVSS score is 6.5, indicating a moderate risk. EPSS is less than 1%, suggesting a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The flaw can be exploited remotely by sending malicious requests to the search endpoint over HTTP(S); no local privilege or authentication is required, making the attack vector potentially network-based. Successful exploitation would result in service interruption for Kibana consumers.