Description

Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization is evaluated with a worst-case cost that grows disproportionately with the size of the input. Because the evaluation runs synchronously, a single request consumes the Kibana request-processing thread indefinitely, and Kibana stops responding to all further requests until the service is restarted.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:26.787Z",
  "pubdate": "2026-08-13T20:17:26.787Z",
  "executiveSummary": "An Inefficient Algorithmic Complexity vulnerability (CWE-407) exists within Kibana, specifically impacting the Time Series Visual Builder (TSVB) component. This flaw enables unauthenticated or authenticated threat actors to execute a denial of service (DoS) attack via Input Data Manipulation (CAPEC-153). By submitting a specially crafted, deeply nested expression to a TSVB visualization, an attacker can trigger a worst-case computational cost that scales disproportionately relative to the input size.\nThe primary operational impact is a complete loss of service availability. Because the evaluation of the malicious payload executes synchronously within the Node.js event loop or request-processing thread, a single crafted request consumes processing resources indefinitely. Consequently, the Kibana instance stops responding to all subsequent incoming requests, effectively hanging the application until the service is manually or automatically restarted.\nThe risk implication is severe for environments lacking strict input filtering or rate limiting, as it allows a low-complexity remote attack vector to disrupt observability pipelines and security monitoring platforms. Exploitation requirements are minimal, necessitating only the ability to submit a targeted visualization request containing the malicious expression payload to the vulnerable TSVB endpoint.",
  "technicalDetails": "The root cause of this vulnerability lies in the algorithmic handling of nested expressions within the Kibana TSVB visualization rendering engine. When processing user-supplied visualization definitions or expressions, the parsing or evaluation logic fails to enforce constraints on recursion depth or computational complexity. Consequently, supplying a deeply nested expression forces the evaluation engine into a worst-case performance trajectory where execution time grows disproportionately, characteristic of exponential or high-order polynomial time complexity.\nThe vulnerable component is the TSVB visualization evaluation pipeline inside Kibana. Attackers exploit this component by constructing a malicious payload consisting of deeply nested syntax or recursive logical structures within a visualization query or configuration request. This payload is transmitted over the network via standard HTTP protocols to the Kibana application server handling TSVB requests.\nThe step-by-step attack flow proceeds as follows: First, the attacker crafts a payload utilizing a deeply nested expression designed to maximize parser or evaluator overhead. Second, the attacker transmits this payload in a request directed at the TSVB visualization endpoint. Third, the Kibana server receives the request and initiates synchronous evaluation of the expression on its main request-processing thread. Fourth, due to the inefficient algorithmic complexity, the evaluation consumes excessive CPU cycles and time, blocking the single-threaded event loop indefinitely. Finally, because the thread is pinned processing the malicious payload, the application becomes unresponsive to all other operational or administrative requests, resulting in a denial of service.\nNetwork exposure is inherent to any deployment where users or attackers can interact with Kibana dashboards and TSVB visualizations. The payload behavior centers on resource exhaustion, specifically locking up computational threads without generating conventional crash logs or memory leaks. The post-exploitation impact is limited to availability disruption; however, in enterprise monitoring scenarios, taking down Kibana blinds security operations centers and infrastructure teams, potentially masking concurrent malicious activities."
}