The flaw is an uncontrolled resource consumption issue that allows an authenticated user to send requests with excessively large input values through Kibana’s automatic import feature. When several such requests are made at the same time, the backend services become unstable, leading to a loss of availability for all users. The vulnerability does not expose or modify data, but it can suspend normal operation, preventing legitimate use of Kibana.

Elastic’s Kibana product is affected. The advisory references multiple releases, such as 8.19.14, 9.2.8, and 9.3.3, but no explicit version range is supplied. Administrative users with access to automatic import are the risk group for the affected installations.

The issue carries a CVSS score of 6.5, indicating moderate severity. Exploitation requires that the attacker already be authenticated with a role that permits use of the automatic import feature; it is not a remote unauthenticated attack vector. Because the CVE is not listed in the CISA KEV catalog and EPSS data is not available, the potential for exploitation is considered moderate but real. Concurrency of large inputs is needed to trigger the denial of service, which suggests that the attack is feasible in a coordinated or automated fashion.