Description
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this user-supplied input requires resource-intensive memory allocation that can exhaust the available heap memory in the Kibana process, causing it to crash and become unavailable to all users.
Published: 2026-07-21
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Uncontrolled Resource Consumption (CWE-400) allows an authenticated, low‑privilege user to trigger a denial of service by sending a specially crafted, oversized request payload to Kibana. The request forces the server to allocate large amounts of memory, exhausting the available heap and causing the Kibana process to crash, which makes the service unavailable to all users.

Affected Systems

Elastic Kibana is impacted. The specific affected versions are not listed, so all installations of Kibana that are reachable by authenticated users should be considered at risk until a patch is applied.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity. EPSS is reported as less than 1%, suggesting a low likelihood of exploitation and it is not listed in CISA’s KEV catalog. It requires authenticated low‑privilege access and relies on sending a large request body; exploitation is therefore limited to users who can authenticate to the application.

Generated by OpenCVE AI on August 4, 2026 at 00:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest Elastic Kibana release that contains the mitigation for update.
  • Configure request size limits or input validation in Kibana to reject excessively large payloads, reducing the ability to exhaust heap memory.
  • Monitor Kibana heap usage and set appropriate memory limits or alerts to detect potential resource exhaustion before a crash occurs.

Generated by OpenCVE AI on August 4, 2026 at 00:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Jul 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jul 2026 05:30:00 +0000

Type Values Removed Values Added
First Time appeared Elastic
Elastic kibana
Vendors & Products Elastic
Elastic kibana

Tue, 21 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
Description Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this user-supplied input requires resource-intensive memory allocation that can exhaust the available heap memory in the Kibana process, causing it to crash and become unavailable to all users.
Title Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
Weaknesses CWE-400
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Elastic Kibana
cve-icon MITRE

Status: PUBLISHED

Assigner: elastic

Published:

Updated: 2026-07-22T13:08:57.152Z

Reserved: 2026-07-16T03:26:51.579Z

Link: CVE-2026-63260

cve-icon Vulnrichment

Updated: 2026-07-22T13:08:53.051Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T00:30:18Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption