Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentially increasing amounts of memory by submitting a specially crafted Timelion visualization expression containing deeply chained function calls. The resulting data structure grows without bound, exhausting available memory and causing the Kibana service to crash and become unavailable to all users.
References
| Link | Resource |
|---|---|
| https://discuss.elastic.co/t/kibana-8-19-16-and-9-3-5-security-update-esa-2026-36/386556 | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
01 Jun 2026, 14:14
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:* | |
| First Time |
Elastic
Elastic kibana |
|
| References | () https://discuss.elastic.co/t/kibana-8-19-16-and-9-3-5-security-update-esa-2026-36/386556 - Vendor Advisory |
28 May 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-28 21:16
Updated : 2026-06-01 14:14
NVD link : CVE-2026-42399
Mitre link : CVE-2026-42399
CVE.ORG link : CVE-2026-42399
JSON object : View
Products Affected
elastic
- kibana
CWE
CWE-400
Uncontrolled Resource Consumption