Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted request to affected Entity Analytics endpoints containing an oversized input value that causes excessive resource consumption, which may render Kibana unavailable.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://discuss.elastic.co/t/kibana-9-3-7-9-4-4-security-update-esa-2026-55/388554/1 Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.5 · elasticNVD modified 2026-10-24 19:10
Affected (CPE criteria) 1
cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*