The vulnerability is a resource exhaustion flaw in Kibana that allows an authenticated user to trigger unbounded allocation of memory and CPU by submitting a specially crafted bulk deletion request. When the request is processed, Kibana allocates resources for each item without enforcing limits or throttling, which can overwhelm the underlying system. The effect is that the web interface becomes unresponsive or completely unavailable, impairing legitimate users’ ability to interact with the platform. This weakness is classified as CWE‑770, a failure to control resource usage.

Elastic’s Kibana is affected. The advisory does not specify precise vulnerable version ranges, but any instance that has not applied a security update introducing limits on bulk deployed Kibana version and confirm whether such an update has been installed.

With a CVSS score of 6.5 the flaw carries moderate impact, and an EPSS score of less than 1% indicates a very low likelihood of live exploitation. The vulnerability has not been reported in CISA’s KEV catalog, suggesting no known widespread attacks. Exploitation requires an authenticated user with sufficient permissions to execute a bulk delete; once the denial of service can persist until the offending process is stopped or the node is rebooted.