The vulnerability is an uncontrolled resource consumption flaw (CWE-400). An authenticated user can supply a specially crafted compressed request that is decompressed before authorization checks, leading to excessive memory and CPU usage. This excessive allocation can cause a Kibana instance to become unresponsive or crash, resulting in a denial of service.

The affected product is Elastic Kibana. No specific version information is provided in the available data, so all releases of this product are potentially impacted.

The CVSS score of 6.5 indicates a medium severity impact. EPSS data is not available, so the likelihood of exploitation is uncertain but could be higher in environments where authentication is easily achieved. The vulnerability is not listed in CISA KEV, but the attack requires an authenticated user and the malicious payload is processed before authorization, meaning that anyone who can authenticate to the Kibana instance could potentially trigger the resource exhaustion.