CVE-2026-33465
Undergoing Analysis Undergoing Analysis - In Progress

Allocation of Resources Without Limits in Kibana

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Elastic

Description
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level permissions could submit a specially crafted request that causes excessive resource consumption, which may render Kibana unavailable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-02
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-33465
EUVD
EUVD-2026-69557

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
elastic kibana From 8.0.0 (inc) to 8.19.16 (inc)
elastic kibana From 9.0.0 (inc) to 9.2.8 (inc)
elastic kibana 8.19.17
elastic kibana 9.3.0
elastic kibana *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-33465 is an Allocation of Resources Without Limits or Throttling vulnerability in Kibana. An authenticated user with low-level permissions can submit a specially crafted request that causes excessive resource consumption, leading to a denial of service.

Detection Guidance

Monitor Kibana logs for unusually high resource consumption or failed requests. Check for repeated requests from authenticated users with low-level permissions. Use system monitoring tools like top, htop, or netstat to observe CPU, memory, and network usage spikes.

Impact Analysis

This vulnerability can make Kibana unavailable due to excessive resource consumption. It may disrupt services relying on Kibana for data visualization or monitoring.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing unavailability of Kibana, which may disrupt logging, monitoring, or data processing activities. Denial of service conditions could lead to failures in tracking user activity or handling sensitive data, potentially violating availability requirements in these regulations.

Mitigation Strategies

Upgrade Kibana to version 8.19.17 or later, or 9.3.0 or later. If upgrading is not possible, restrict access to low-level permissions and monitor for suspicious activity. Consider disabling non-essential features temporarily.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33465. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart