Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana process to spend an unbounded amount of time evaluating it. An authenticated user with read-only privileges was able to send a single request that left Kibana unable to serve any user until the process was restarted.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:22.467Z",
  "pubdate": "2026-08-13T20:17:22.467Z",
  "executiveSummary": "An Allocation of Resources Without Limits or Throttling vulnerability, categorized as CWE-770 and mapping to CAPEC-130 (Excessive Allocation), has been identified in Kibana.\nThe vulnerability allows an authenticated user with read-only privileges to trigger a denial of service against the Kibana service by supplying an oversized query expression to a connector reporting operation.\nThe lack of validation and resource throttling permits the acceptance of unbounded query expressions, forcing the Kibana process to expend an excessive amount of CPU and memory resources evaluating the payload.\nThis resource exhaustion locks up the affected Kibana instance, rendering it completely unresponsive to subsequent user requests until manual process intervention, specifically a service restart, is performed.\nThe risk implication is high regarding operational availability, as it allows low-privilege internal actors or compromised accounts to disrupt core reporting and monitoring capabilities.\nExploitation requires authentication with read-only privileges and the ability to interact with the connector reporting operation endpoint.",
  "technicalDetails": "The root cause of this vulnerability stems from insufficient input validation and a total absence of resource allocation limits or request throttling within the query expression evaluation logic.\nThe vulnerable component resides within the connector reporting operation subsystem of Kibana, which handles the parsing and execution of query expressions.\nBecause the application fails to enforce size restrictions or execution timeouts on incoming expressions, an attacker can craft a maliciously sized or highly complex query expression designed to maximize computational complexity during evaluation.\nThe attack flow proceeds as follows: First, the authenticated user, holding standard read-only privileges, crafts an oversized query expression payload. Second, the user submits this payload via a single HTTP request directed at the connector reporting operation endpoint. Third, the Kibana backend accepts the request without enforcing input size constraints and passes the expression to the evaluation engine. Fourth, the engine attempts to process the unbounded structure, causing the single-threaded or synchronous execution context to consume 100 percent of allocated CPU cycles and memory for an extended, unbounded duration. Finally, this excessive resource allocation starves all other threads and processes, resulting in an unrecoverable denial of service condition where Kibana cannot serve any incoming user requests.\nNetwork exposure is defined by access to the Kibana web interface or underlying APIs, requiring the attacker to possess valid credentials, albeit restricted to read-only privileges.\nPost-exploitation impact is strictly focused on availability degradation, resulting in a persistent denial of service that requires administrative intervention to restart the crashed or hung Kibana process."
}