The vulnerability is an improper validation of the specified quantity in input to the Timelion visualization plugin, classified as CWE‑1284. An authenticated user can craft a Timelion expression that overwrites internal series data properties with an excessively large value, causing the plugin to allocate more resources than intended and leading to a denial of service. The impact is a disruption of user services within Kibana and potential instability of the underlying cluster.

This defect affects installations of Elastic Kibana that include the Timelion visualization plugin. No specific version range is listed in the CVE entry, so all releases that have Timelion enabled are potentially vulnerable until the vendor releases a fix.

The CVSS score of 6.5 indicates a moderate severity. EPSS is reported to be less than 1%, suggesting low current exploitation likelihood, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a legitimate authenticated session. Attackers would need to inject a specially crafted Timelion expression; thus, privileged users are the primary target. Even though the risk of rapid exploitation is low, the denial of service can impact multiple stakeholders if not mitigated.