Inefficient Regular Expression Complexity in Kibana’s AI Inference Anonymization Engine allows an attacker to craft a regular expression that triggers exponential blowup, leading to a denial of service. The flaw is classified as CWE‑1333 and can disrupt the availability of the Kibana service by exhausting CPU and memory resources.

The affected product is Elastic Kibana. No specific version information is listed in the advisory; all currently supported releases before the fix are potentially vulnerable.

The CVSS score is 4.9, indicating moderate risk, and the EPSS score is below 1 %, showing a very low probability of exploitation. Because the vulnerability stems from the AI inference engine, the likely attack vector is sending a malicious regular expression via the relevant Kibana API, but exploitation details are not publicly documented. The issue is not included in the CISA KEV catalog.