Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Kibana visualization feature by an authenticated user holding only low-privileged access is not correctly validated before use. Processing the request causes unbounded memory growth in the Kibana process, which is terminated by the host once available memory is exhausted. Kibana then becomes unavailable to all users until the service is restarted.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:26.180Z",
  "pubdate": "2026-08-13T20:17:26.180Z",
  "executiveSummary": "An Allocation of Resources Without Limits or Throttling vulnerability, classified as CWE-770, has been identified in Kibana. This security flaw enables threat actors to induce a denial of service state via Excessive Allocation, mapping to CAPEC-130.\nThe vulnerability directly impacts the availability of the Kibana service by allowing resource exhaustion through uncontrolled memory consumption. When successfully exploited, the Kibana process experiences unbounded memory growth until the host operating system terminates the process, rendering the application entirely unavailable to all users until manual or automated service restarts are performed.\nThe affected product is Kibana, specifically impacting the visualization feature. The risk implications are severe regarding service availability, as operational continuity is completely disrupted.\nRegarding attacker capabilities and exploitation requirements, the attack vector requires authentication, but the necessary privileges are minimal, as the vulnerability can be triggered by a user holding only low-privileged access. No complex prerequisites are mentioned beyond submitting the malicious vector.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient input validation and a lack of resource allocation limits within a Kibana visualization feature. Specifically, when a specially crafted, malformed payload is submitted to the visualization component, the application fails to correctly validate the input structure and size parameters prior to processing.\nThe exploitation method relies on supplying a maliciously engineered payload designed to bypass initial checks, which the application then attempts to parse and process. The vulnerable component is the visualization processing subsystem within the Kibana process architecture.\nThe step-by-step attack flow proceeds as follows: First, an authenticated user with low-privileged access crafts a malformed payload targeting the Kibana visualization feature. Second, the user submits this payload over the network to the application endpoint. Third, the visualization subsystem accepts the request without performing rigorous validation on the input's resource demands. Fourth, as the Kibana process attempts to process the malformed data, it triggers unbounded memory growth, rapidly consuming the available random access memory on the host system. Finally, the host operating system's out-of-memory killer or resource monitor terminates the Kibana process to preserve system stability, resulting in an immediate denial of service.\nThe exploitation prerequisites include network exposure to the Kibana instance, a valid user session requiring only low-privileged access, and the ability to interact with the visualization feature. The post-exploitation impact is strictly focused on availability, causing complete service disruption until the affected service is restarted by administrative intervention."
}