Executive brief
Kibana, Elastic's data visualization and analytics platform, contains a flaw in how it processes highly compressed data used in Streams management. An authenticated user with Streams management privileges can upload specially crafted compressed content that expands to enormous sizes, exhausting Kibana's memory and crashing the service until manually restarted, affecting all users' access to dashboards and analytics.
Technical details
The vulnerability is an improper handling of highly compressed data (CWE-409, data amplification attack) in Kibana's Streams functionality. When a user with Streams management privileges uploads specially crafted compressed content through the content packs feature, the data expands to a far larger volume during processing, exhausting available memory. The vulnerability requires Streams to be enabled, content packs capability to be enabled (both non-default), and the attacker to hold Streams management privileges. An exploit causes the Kibana process to be terminated by the host, rendering it unavailable to all users until the service is restarted. Patches are available in versions 8.19.21, 9.4.6, and 9.5.2; users unable to upgrade can disable the observability:streamsEnableContentPacks advanced setting as a mitigation.
Affected products
- Elastic Kibana 8.x: 8.19.0 to 8.19.20; 9.x: 9.0.0 to 9.4.5, 9.5.0 to 9.5.1
Timeline
- 2026-09-01: disclosed