Executive brief
Kibana, a popular data visualization and management platform for the Elastic Stack, is vulnerable to a denial-of-service attack. An authenticated user can send a specially crafted compressed request that consumes excessive system memory and CPU. This can cause the Kibana service to become unresponsive or crash, disrupting data analysis and monitoring operations.
Technical details
A vulnerability in Kibana (CWE-400) allows for uncontrolled resource consumption via excessive allocation (CAPEC-130). The flaw exists because Kibana processes compressed request payloads before performing authorization checks. An authenticated attacker can exploit this by sending a malicious payload that triggers high CPU and memory usage during decompression or processing. This results in a denial of service (DoS) where the Kibana instance crashes or stops responding to legitimate traffic. The issue is resolved in versions 8.19.16, 9.3.5, and 9.4.2.
Affected products
- Elastic Kibana 8.0.0 to 8.19.15, 9.0.0 to 9.3.4, 9.4.0 to 9.4.1
Timeline
- 2026-05-28: disclosed
- 2026-05-28: advisory
- 2026-05-28: patched: Remediated in Elastic Cloud Serverless prior to public disclosure.