CVE-2026-72663
Received Received - Intake

Denial of Service in Kibana via Algorithmic Complexity

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Elastic

Description
Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization is evaluated with a worst-case cost that grows disproportionately with the size of the input. Because the evaluation runs synchronously, a single request consumes the Kibana request-processing thread indefinitely, and Kibana stops responding to all further requests until the service is restarted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-14
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-72663
EUVD
EUVD-2026-58273

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
elastic kibana *
elastic kibana From 8.0.0 (inc) to 8.19.19 (inc)
elastic kibana From 9.0.0 (inc) to 9.4.4 (inc)
elastic kibana 8.19.20
elastic kibana 9.4.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72663 is a denial-of-service vulnerability in Kibana caused by inefficient algorithmic complexity in evaluating deeply nested expressions in TSVB visualizations. Attackers can exploit this by submitting specially crafted input to consume all request-processing threads, making Kibana unresponsive until restarted.

Detection Guidance

Detecting this vulnerability requires checking Kibana versions and monitoring for unresponsive instances. Verify installed versions with commands like 'curl -XGET http://localhost:5601/api/status' or 'dpkg -l | grep kibana' (Debian/Ubuntu) or 'rpm -qa | grep kibana' (RHEL/CentOS). Look for versions between 8.0.0-8.19.19 or 9.0.0-9.4.4. Monitor for Kibana becoming unresponsive or high CPU usage during TSVB visualization interactions.

Impact Analysis

This vulnerability allows attackers to disrupt Kibana services by sending malicious requests, causing the system to stop responding to all other requests. This leads to downtime and potential loss of access to critical data and dashboards until the service is manually restarted.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR or HIPAA by causing service disruption. Denial of service conditions may lead to unauthorized data access or processing delays, which could violate availability requirements under these regulations. However, the CVE itself does not explicitly address compliance implications.

Mitigation Strategies

Immediately upgrade Kibana to versions 8.19.20 or 9.4.5. If upgrading is not possible, disable TSVB visualizations by adding 'xpack.reporting.enabled: false' and 'xpack.reporting.kibanaServer.hostname: null' to kibana.yml. For Elastic Cloud users, apply the provided security update. Restart Kibana after changes to ensure mitigation takes effect.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72663. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart