BaseFortify

Publication date: 2025-12-18

Last updated on: 2025-12-23

Assigner: Elastic

Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resources and a denial of service (DoS) of the Kibana process via a crafted HTTP request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-18

Last Modified

2025-12-23

Generated

2026-07-07

AI Q&A

2025-12-19

EPSS Evaluated

2026-07-05

NVD

CVE-2025-68389

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	From 7.0.0 (inc) to 7.17.29 (inc)
elastic	kibana	From 8.0.0 (inc) to 8.19.9 (exc)
elastic	kibana	From 9.0.0 (inc) to 9.1.9 (exc)
elastic	kibana	From 9.2.0 (inc) to 9.2.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability in Kibana involves allocation of resources without limits or throttling, which allows a low-privileged authenticated user to cause excessive allocation of computing resources by sending a crafted HTTP request. This can lead to a denial of service (DoS) of the Kibana process.

Impact Analysis

The vulnerability can impact you by enabling a low-privileged user to cause excessive consumption of computing resources, potentially leading to a denial of service (DoS) of the Kibana process, which can disrupt availability and functionality.

Hi! I’m here to help you understand CVE-2025-68389. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70