Threat Investigation
Request a demo

CVE-2026-72651

Medium

Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the alerting feature could submit a specially crafted, malformed payload that causes the Kibana process to consume excessive resources. A single request is sufficient to leave Kibana unable to serve requests for all users until the process is restarted.

SeverityMedium
CVSS6.5
Exploit probability—
ProductElastic Kibana
PublishedAug 13, 2026
First seenAug 13, 2026
Weakness typeCWE-770Allocation of resources without limits

How to fix

Update
  • elastic kibana8.19.20, 9.4.5 or later

Affected products

ProductAffected versionsFixed in
elastic kibana8.0.0 ≤ v < 8.19.20, 9.0.0 ≤ v < 9.4.58.19.20, 9.4.5

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.