Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with read-only privileges to the alerting feature could submit a specially crafted, malformed payload that causes the Kibana process to consume excessive resources. A single request is sufficient to leave Kibana unable to serve requests for all users until the process is restarted.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:25.393Z",
  "pubdate": "2026-08-13T20:17:25.393Z",
  "executiveSummary": "An Allocation of Resources Without Limits or Throttling vulnerability, classified as CWE-770, exists in the Kibana alerting feature. This vulnerability enables a denial of service state via Excessive Allocation, corresponding to CAPEC-130.\nThe primary impact of this security flaw is the complete exhaustion of system resources within the Kibana process, rendering the application entirely unresponsive to all users and requiring a manual process restart to restore service availability.\nThe affected product is Kibana, specifically impacting the alerting subsystem. The risk implications are severe due to the low barrier to execution and the high-impact outcome of complete service disruption.\nThe attacker capabilities required to exploit this vulnerability include authenticated access with read-only privileges specifically assigned to the alerting feature. The exploitation requirement involves submitting a specially crafted, malformed payload through the alerting interface.",
  "technicalDetails": "The root cause of the vulnerability stems from the absence of proper input validation, resource allocation limits, and request throttling mechanisms within the Kibana alerting feature.\nThe vulnerable component is the alerting subsystem of Kibana, which improperly handles malformed input structures. The authentication requirement is authenticated access, and the privilege requirement is limited to read-only access to the alerting feature.\nExploitation occurs when an authenticated user with read-only privileges to the alerting feature submits a specially crafted, malformed payload to the application.\nUpon submission, the vulnerable component processes the malicious input without enforcing resource bounds. This payload behavior forces the underlying execution environment to consume excessive system resources, such as memory or CPU cycles, driven by inefficient parsing or unbounded data structures.\nThe attack flow proceeds in a single step: a single crafted request is sufficient to trigger the excessive resource allocation condition.\nThe post-exploitation impact results in a denial of service condition where the Kibana process exhausts its available resources and becomes completely unable to serve incoming requests for any users. Recovery from this state requires administrative intervention to restart the affected Kibana process."
}