Uncontrolled Resource Consumption in Kibana Leading to Denial of Service (Elastic Kibana)
En bref
- Source
- NVD
- EPSS
- EPSS 0.27 % · centile 20 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- elastic
- Statut NVD
- Analyzed
Description
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a specially crafted, oversized payload to an internal Kibana API, causing the Kibana process to exhaust available resources and become unresponsive to all users until the service recovers or is restarted.
Faiblesses (CWE)
- CWE-400 — Consommation de ressources non maîtrisée (déni de service)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | elastic |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · security@elastic.co (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-33010
- GCVE · GCVE-0-2026-33464
Avis du CERT-FR
- CERTFR-2026-AVI-0661 — Multiples vulnérabilités dans Elastic Kibana · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*≥ 8.0.0 < 8.19.16cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*≥ 9.0.0 < 9.3.5cpe:2.3:a:elastic:kibana:9.4.0:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Elastic · Kibana | affected 9.4.0 ≤ 9.4.0 ; affected 9.0.0 ≤ 9.3.4 ; affected 8.0.0 ≤ 8.19.15 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |