Executive brief
Kibana is a data visualization dashboard used to analyze and explore large datasets. A vulnerability in the Timelion visualization feature allows an authorized user to crash the service by submitting a complex request that consumes all available system memory. This results in a total service outage, making the dashboard unavailable to all other users until the system is restarted.
Technical details
An uncontrolled resource consumption vulnerability (CWE-400) exists in Kibana's Timelion visualization component. The flaw is triggered when a user submits a visualization expression containing deeply chained function calls, which causes the underlying data structure to grow exponentially. This leads to excessive memory allocation (CAPEC-130), eventually exhausting the heap and crashing the Kibana process. The attack requires network access and low-privileged authentication. The issue is resolved in Kibana versions 8.19.16 and 9.3.5.
Affected products
- Elastic Kibana 8.0.0 to 8.19.15, 9.0.0 to 9.3.4
Timeline
- 2026-05-28: disclosed
- 2026-05-28: patched: Fixed in 8.19.16 and 9.3.5