Description
Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges could supply specially crafted content that expands to a far larger volume of data during processing, exhausting the memory available to Kibana. The Kibana process is terminated by the host and remains unavailable to all users until the service is restarted.
Published: 2026-09-01
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

Incorrect handling of heavily compressed data in Kibana can cause a denial of service by forcing the process to allocate an excessive amount of memory, eventually leading to termination of the Kibana service.

Affected Systems

The vulnerability affects Kibana provided by Elastic. No specific version range is listed, so all releases before the next security update could potentially be susceptible.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity, and the EPSS score is not available, suggesting no known public exploitation at this time. The exploit requires an authenticated user with streams‑management privileges to supply crafted data, so it is not a remote code‑execution vulnerability but can disrupt service availability for all users until the process is restarted.

Generated by OpenCVE AI on September 2, 2026 at 01:34 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check for and install the latest Elastic Kibana release that contains the fix for this vulnerability.
  • If an upgrade is not immediately possible, revoke or restrict streams‑management privileges from all users until the patch is applied.
  • Configure appropriate memory limits in kibana.yml or through system settings to prevent excessive memory allocation during data processing.

Generated by OpenCVE AI on September 2, 2026 at 01:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 02 Sep 2026 10:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*

Wed, 02 Sep 2026 01:00:00 +0000

Type Values Removed Values Added
First Time appeared Elastic
Elastic kibana
Vendors & Products Elastic
Elastic kibana

Tue, 01 Sep 2026 22:00:00 +0000

Type Values Removed Values Added
Description Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges could supply specially crafted content that expands to a far larger volume of data during processing, exhausting the memory available to Kibana. The Kibana process is terminated by the host and remains unavailable to all users until the service is restarted.
Title Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service
Weaknesses CWE-409
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Subscriptions

Elastic Kibana
cve-icon MITRE

Status: PUBLISHED

Assigner: elastic

Published:

Updated: 2026-09-01T19:37:26.698Z

Reserved: 2026-08-10T11:17:29.887Z

Link: CVE-2026-72628

cve-icon Vulnrichment

Updated: 2026-09-01T19:37:23.729Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-01T20:17:16.373

Modified: 2026-09-02T14:14:18.020

Link: CVE-2026-72628

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-02T01:45:05Z

Weaknesses
  • CWE-409

    Improper Handling of Highly Compressed Data (Data Amplification)