A request handling flaw in Kibana lets an authenticated user with minimal privileges send a specially crafted payload to the Observability log analysis validation endpoint, causing the service to spawn an unbounded amount of concurrent work. The resulting memory exhaustion can bring the Kibana process to a halt or degrade performance, impacting all users until the service is restarted. The weakness matches CWE‑770, which describes allocations made without bounds or throttling.

The vulnerability affects Elastic’s Kibana product. No specific release versions are disclosed in the CVE data.

The CVSS score is 6.5, indicating a medium severity. No EPSS value is published, so the exploitation likelihood is unknown from the data; the issue is not listed in the CISA KEV catalog. Attack requires a valid user account with access to the Observability feature, which is usually granted to any authenticated user, making the attack vector relatively low‑barrier. An attacker could repeat the request to exacerbate the impact, potentially leading to a full service outage if the deployment lacks sufficient resources.