CVE-2026-49094

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit a request containing an oversized input value to an analytics collections management endpoint. Kibana will consume excessive CPU and memory resources while processing the request. This results in Kibana becoming unavailable to all users until the service is manually recovered.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://discuss.elastic.co/t/kibana-8-19-16-security-update-esa-2026-39/386561/1	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*

History

21 Jul 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Consumo de Recursos No Controlado (CWE-400) en Kibana puede llevar a denegación de servicio a través de Asignación Excesiva (CAPEC-130). Un usuario autenticado con acceso de nivel de visor puede enviar una solicitud que contiene un valor de entrada sobredimensionado a un endpoint de gestión de colecciones de análisis. Kibana consumirá recursos excesivos de CPU y memoria mientras procesa la solicitud. Esto resulta en que Kibana quede no disponible para todos los usuarios hasta que el servicio sea recuperado manualmente.

01 Jun 2026, 13:31

Type	Values Removed	Values Added
References	~~() https://discuss.elastic.co/t/kibana-8-19-16-security-update-esa-2026-39/386561/1 -~~	() https://discuss.elastic.co/t/kibana-8-19-16-security-update-esa-2026-39/386561/1 - Vendor Advisory
First Time		Elastic Elastic kibana
CPE		cpe:2.3:a:elastic:kibana::::::::

28 May 2026, 21:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-28 21:16

Updated : 2026-07-21 10:10

NVD link : CVE-2026-49094

Mitre link : CVE-2026-49094

CVE.ORG link : CVE-2026-49094

JSON object : View

Products Affected

elastic

kibana

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-49094", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49094", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-29T16:21:11.371589Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@elastic.co", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@elastic.co", "affectedData": [{"vendor": "Elastic", "product": "Kibana", "versions": [{"status": "affected", "version": "8.0.0", "versionType": "semver", "lessThanOrEqual": "8.19.15"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-28T21:16:34.503", "references": [{"url": "https://discuss.elastic.co/t/kibana-8-19-16-security-update-esa-2026-39/386561/1", "tags": ["Vendor Advisory"], "source": "security@elastic.co"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@elastic.co", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit a request containing an oversized input value to an analytics collections management endpoint. Kibana will consume excessive CPU and memory resources while processing the request. This results in Kibana becoming unavailable to all users until the service is manually recovered."}, {"lang": "es", "value": "Consumo de Recursos No Controlado (CWE-400) en Kibana puede llevar a denegaci\u00f3n de servicio a trav\u00e9s de Asignaci\u00f3n Excesiva (CAPEC-130). Un usuario autenticado con acceso de nivel de visor puede enviar una solicitud que contiene un valor de entrada sobredimensionado a un endpoint de gesti\u00f3n de colecciones de an\u00e1lisis. Kibana consumir\u00e1 recursos excesivos de CPU y memoria mientras procesa la solicitud. Esto resulta en que Kibana quede no disponible para todos los usuarios hasta que el servicio sea recuperado manualmente."}], "lastModified": "2026-07-21T10:10:00.103", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43EDC5B3-131D-489E-8447-05C5C599E6A7", "versionEndExcluding": "8.19.16", "versionStartIncluding": "8.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@elastic.co"}