CVE-2026-72628
Undergoing Analysis Undergoing Analysis - In Progress

Improper Data Handling Leads to DoS in Kibana

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: Elastic

Description
Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges could supply specially crafted content that expands to a far larger volume of data during processing, exhausting the memory available to Kibana. The Kibana process is terminated by the host and remains unavailable to all users until the service is restarted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-02
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-72628
EUVD
EUVD-2026-69564

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
elastic kibana From 8.19.0 (inc) to 8.19.20 (inc)
elastic kibana From 9.0.0 (inc) to 9.5.1 (inc)
elastic kibana 8.19.21
elastic kibana 9.4.6
elastic kibana 9.5.2
elastic kibana *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72628 is a denial-of-service vulnerability in Kibana caused by improper handling of highly compressed data. An authenticated user with Streams management privileges can exploit this by providing specially crafted content that expands significantly during processing, exhausting Kibana's memory and causing the process to terminate. The service remains unavailable until manually restarted.

Detection Guidance

Detecting this vulnerability requires checking if your Kibana instance is running a vulnerable version (8.19.0 to 8.19.20 or 9.0.0 to 9.5.1) and if Streams content packs are enabled. Check Kibana version with: curl -XGET 'http://localhost:5601/api/console/api_server?path=info&method=GET'. Verify Streams settings in Kibana UI under Advanced Settings for observability:streamsEnableContentPacks.

Impact Analysis

This vulnerability can disrupt Kibana service availability for all users. If exploited, the Kibana process crashes due to memory exhaustion, making the system inaccessible until restarted. It requires an authenticated user with specific privileges, reducing the risk for most environments where Streams features are disabled by default.

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by causing service unavailability. A denial of service could disrupt access to critical data or systems, potentially violating availability requirements in these regulations. However, the vulnerability requires specific conditions (enabled Streams and content packs) and authenticated user access, which may limit real-world compliance risks.

Mitigation Strategies

Upgrade Kibana to versions 8.19.21, 9.4.6, or 9.5.2. If upgrading is not possible, disable the observability:streamsEnableContentPacks advanced setting in Kibana. Ensure Streams is not enabled if not required. Monitor Kibana service status for unexpected terminations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72628. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart