Executive brief
Kibana, Elastic's analytics and visualization platform used to analyze and visualize data from Elasticsearch clusters, contains a memory exhaustion flaw in its visualization feature that can crash the service. An authenticated user with low privileges can submit a specially crafted malformed payload that causes unbounded memory growth, eventually terminating the Kibana process and making the platform unavailable to all users until restart.
Technical details
This is a resource exhaustion vulnerability (CWE-770) in Kibana's visualization processing, specifically affecting the Timelion visualization type. An authenticated attacker with low-privileged access can submit a specially crafted malformed payload to a visualization endpoint without proper input validation. The vulnerable code fails to impose limits on memory allocation during payload processing, resulting in unbounded memory growth that exhausts host memory and causes the Kibana process to be terminated by the operating system. This denial of service renders Kibana unavailable to all users until manual service restart. The vulnerability requires network access and valid authentication credentials but no special privileges.
Affected products
- Elastic Kibana 8.0.0 to 8.19.19; 9.0.0 to 9.4.4
Timeline
- 2026-08-13: disclosed
- 2026-08-13: patched: Fixed in Kibana 8.19.20 and 9.4.5