Kibana was found to allocate computational resources without any limits or throttling during the processing of a query expression, which is a classic example of CWE-770. An authenticated user, even with read‑only privileges, can submit an oversized expression that forces the Kibana process to spend an unbounded amount of time evaluating it. The result is a denial of service that renders the Kibana instance unresponsive to all users until the process is restarted, potentially crippling monitoring, search, and analytics functions in an organization. The impact is confined to availability; confidentiality and integrity are not directly affected.

The vulnerable component is Elastic Kibana as distributed by Elastic. No specific version information is included in the current advisory, so all installations of Kibana that are still running the affected code base are at risk.

The CVSS score of 6.5 indicates medium severity. The EPSS score is not available, which means we cannot quantify the current exploitation probability, but the fact that the issue is exploitable by an authenticated read‑only user lowers the barrier to attack. The vulnerability is not listed in CISA KEV, suggesting that there are no widely known exploits yet, yet the difficulty of exploitation is low. An attacker would typically issue a single request containing an oversized query expression, which would cause the Kibana process to become saturated and unable to serve other requests.