Uncontrolled Resource Consumption (CWE-400) in Kibana allows an authenticated user with a low‑privileged role to submit a specially crafted, oversized payload to an internal API. The excessive allocation of resources exhausts the Kibana process, rendering it unresponsive to all users until the service recovers or is restarted. The result is a denial of service that affects the availability of dashboards, log access, and other Kibana features.

Elastic Kibana installations that have not applied the latest security update are vulnerable. The issue is present in Kibana systems before the released update referenced in the discussion thread, and any version that lacks the fix will be affected. There is no explicit version range provided, so all current Kibana deployments should be examined.

With a CVSS score of 6.5, the vulnerability represents moderate severity. Explorer probability is not provided, and it is not listed in CISA's KEV. The attack requires authentication and a low‑privileged role, implying an insider or compromised account. If an attacker can send the oversized payload, the Kibana service will consume resources until it crashes or stalls, temporarily denying access to all users. No public exploit is cited, but the lack of mitigations and internal API exposure increase the risk of exploitation.