CVE-2026-49094
Uncontrolled Resource Consumption in Kibana via Excessive Allocation
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: Elastic
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| elastic | kibana | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Uncontrolled Resource Consumption issue (CWE-400) in Kibana. It allows an authenticated user with viewer-level access to send a request with an oversized input value to an analytics collections management endpoint. When processing this request, Kibana consumes excessive CPU and memory resources.
As a result, the system becomes overwhelmed and unavailable to all users until the service is manually recovered.
How can this vulnerability impact me? :
The vulnerability can lead to a denial of service condition in Kibana. Because the system consumes excessive CPU and memory resources when processing a specially crafted request, Kibana becomes unavailable to all users.
This means legitimate users cannot access Kibana until the service is manually restored, potentially disrupting business operations that depend on Kibana.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Kibana to version 8.19.16 or later where the issue is resolved.
If upgrading is not possible immediately, restrict access to the behavioral analytics collections feature to prevent exploitation by authenticated users with viewer-level access.
Note that this vulnerability does not affect Elastic Cloud Serverless deployments.