The vulnerability is an inefficient algorithmic complexity flaw (CWE‑407) that causes Kibana to exhaust its request‑processing thread when evaluating a specially crafted, deeply nested expression. The evaluation runs synchronously on the same thread, so a single malformed request can consume that thread indefinitely. As a result Kibana becomes unresponsive to all subsequent traffic until the service is restarted, creating a denial‑of‑service condition for the affected system.

Elastic Kibana is affected. The CVE payload does not provide specific version information, so all current releases of Elastic Kibana may be vulnerable until an official patch is released.

The CVSS base score of 6.5 indicates moderate severity. Based on the description, the likely attack vector involves an attacker constructing a deeply nested expression and submitting it to a Kibana TSVB visualization endpoint. Because the evaluation runs on the main request thread, a single request can immediately lock that thread and cause a service‑wide outage. The flaw cannot be mitigated by authentication alone; any user who can submit a TSVB visualization can trigger the denial of service. This vulnerability is not listed in CISA’s KEV catalog.