Executive brief
Kibana, a visualization and analytics tool for searching and analyzing log data, contains a flaw that allows authenticated users to exhaust server memory by submitting specially crafted requests. An attacker with low-level user credentials can trigger excessive memory consumption, causing Kibana to become unavailable to all legitimate users and disrupting business operations that rely on log analysis and monitoring.
Technical details
The vulnerability is a resource exhaustion flaw (CWE-770) where Kibana fails to impose limits or throttling on memory allocation in response to specially crafted requests. An authenticated attacker with low-level privileges can submit a crafted request that causes unbounded memory consumption, leading to denial of service. The attack vector is network-based and requires valid authentication credentials but no elevated privileges or user interaction. The impact is availability: the server becomes unresponsive and unavailable to legitimate users. Patches are available in Kibana versions 8.19.16, 9.3.5, and 9.4.2.
Affected products
- Elastic Kibana 8.0.0 to 8.19.15, 9.0.0 to 9.3.4, 9.4.0 to 9.4.1
Timeline
- 2026-09-02: disclosed
- 2026-09-02: patched: Fixes available in Kibana 8.19.16, 9.3.5, and 9.4.2