Improper Validation of Specified Quantity in Input (CWE-1284) in Kibana can allow an authenticated attacker with view-only privileges to cause a Denial of Service via Input Data Manipulation (CAPEC-153). An attacker can send a specially crafted, malformed payload causing excessive resource consumption and resulting in Kibana becoming unresponsive or crashing.
References
| Link | Resource |
|---|---|
| https://discuss.elastic.co/t/kibana-8-19-12-9-2-6-9-3-1-security-update-esa-2026-12/385248 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
02 Mar 2026, 15:59
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:* cpe:2.3:a:elastic:kibana:9.3.0:*:*:*:*:*:*:* |
|
| First Time |
Elastic
Elastic kibana |
|
| References | () https://discuss.elastic.co/t/kibana-8-19-12-9-2-6-9-3-1-security-update-esa-2026-12/385248 - Vendor Advisory |
26 Feb 2026, 18:23
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-02-26 18:23
Updated : 2026-03-02 15:59
NVD link : CVE-2026-26934
Mitre link : CVE-2026-26934
CVE.ORG link : CVE-2026-26934
JSON object : View
Products Affected
elastic
- kibana
CWE
CWE-1284
Improper Validation of Specified Quantity in Input