CVE-2026-72659

Received Received - Intake

Allocation of Resources Without Limits in Kibana

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Kibana visualization feature by an authenticated user holding only low-privileged access is not correctly validated before use. Processing the request causes unbounded memory growth in the Kibana process, which is terminated by the host once available memory is exhausted. Kibana then becomes unavailable to all users until the service is restarted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-13

Generated

2026-08-14

AI Q&A

2026-08-14

EPSS Evaluated

N/A

NVD

CVE-2026-72659

EUVD

EUVD-2026-58270

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	kibana	*
elastic	kibana	From 8.0.0 (inc) to 8.19.19 (inc)
elastic	kibana	From 9.0.0 (inc) to 9.4.4 (inc)
elastic	kibana	8.19.20
elastic	kibana	9.4.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-72659 is an Allocation of Resources Without Limits or Throttling vulnerability in Kibana. It allows an authenticated low-privileged user to submit a malformed payload to a visualization feature. This triggers unbounded memory growth in the Kibana process, causing it to terminate when memory is exhausted. The service becomes unavailable until restarted.

Detection Guidance

Monitor Kibana process memory usage for abnormal spikes. Check logs for excessive allocation errors or crashes. Use system monitoring tools like top, htop, or ps to observe Kibana's memory consumption.

Impact Analysis

This vulnerability can lead to denial of service, making Kibana unavailable to all users. It requires an authenticated user with low privileges to exploit. The impact is service disruption until the process is restarted or the system is upgraded.

Mitigation Strategies

Upgrade Kibana to version 8.19.20 or 9.4.5. If upgrading is not possible, disable the Timelion visualization type in kibana.yml or Elastic Cloud settings to reduce risk.

Hi! I’m here to help you understand CVE-2026-72659. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70