Executive brief
Kibana, a popular data visualization and management platform for the Elastic Stack, is vulnerable to a denial-of-service attack. An authorized user can send a specially crafted request to the Entity Analytics component that forces the system to consume excessive resources. This can cause the Kibana interface to become unresponsive or completely unavailable to all users, disrupting monitoring and data analysis operations.
Technical details
A resource exhaustion vulnerability (CWE-770) exists in Kibana's Entity Analytics endpoints. The application fails to properly limit or throttle resource allocation when processing specific requests. An authenticated attacker with access to Entity Analytics can submit a request containing an oversized input value, triggering excessive memory or CPU consumption (CAPEC-130). This results in a denial-of-service (DoS) condition for the Kibana instance. The vulnerability is resolved in Kibana versions 9.3.7 and 9.4.4; no workarounds are currently available for affected versions.
Affected products
- Elastic Kibana 9.3.0 to 9.3.6, 9.4.0 to 9.4.3
Timeline
- 2026-07-21: advisory: Elastic published security update ESA-2026-55
- 2026-07-21: patched: Fixes released in versions 9.3.7 and 9.4.4