Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature causes Kibana to perform an unbounded amount of concurrent work. This can exhaust the memory available to the Kibana process and make Kibana unavailable to all users until it is restarted. The severity of the outcome depends on the resources allocated to the deployment; on well-provisioned deployments a single request may cause degraded performance and elevated memory pressure rather than a full outage, but the request is inexpensive to repeat.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:27.283Z",
  "pubdate": "2026-08-13T20:17:27.283Z",
  "executiveSummary": "An Allocation of Resources Without Limits or Throttling vulnerability, classified as CWE-770 and mapped to CAPEC-130, exists in Kibana. This security flaw enables authenticated users with minimal privileges to trigger a denial of service (DoS) against the affected system via excessive memory allocation.\nThe vulnerability resides within the validation capability of the Observability log analysis feature. By submitting a specially crafted request, an attacker can force the Kibana process to execute an unbounded amount of concurrent work, rapidly exhausting available system memory.\nThe severity and final outcome of the exploitation heavily depend on the underlying resources allocated to the deployment. On well-provisioned deployments, a single malicious request may only induce degraded performance and elevated memory pressure rather than an immediate full service outage. However, because the attack payload is extremely inexpensive to repeat, an attacker can continuously bombard the validation endpoint to sustain the resource exhaustion state.\nThe risk implication is high for service availability, as successful exploitation disrupts access for all users, requiring a manual process restart to restore functionality. Remediation requires applying official patches or updates provided by the vendor.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient resource management, rate limiting, and concurrency throttling within a validation capability associated with the Observability log analysis feature in Kibana, matching CWE-770 (Allocation of Resources Without Limits or Throttling).\nAuthentication is required to exploit this vulnerability, but the necessary privilege level is minimal, allowing any authenticated user to interact with the vulnerable validation feature. The attack vector is network-based, targeting the web application interface of the Kibana deployment.\nThe step-by-step attack flow proceeds as follows: First, the low-privileged authenticated user crafts a malicious input payload specifically designed to exploit the parsing or validation logic of the Observability log analysis feature. Second, the attacker transmits this specially crafted request to the validation endpoint over the network. Third, upon receiving the request, the vulnerable component fails to enforce boundaries on resource consumption, causing the Kibana process to initiate an unbounded amount of concurrent work to process the validation routine.\nAs the application processes the unbounded workload, memory consumption spikes dramatically. This behavior leads directly to memory exhaustion of the Node.js or hosting process running Kibana. Depending on the memory limits and resource provisioning of the target infrastructure, this memory starvation either causes severe performance degradation and elevated memory pressure or triggers an outright application crash resulting in a complete denial of service for all legitimate users. The service remains unavailable until the Kibana process is manually or automatically restarted.\nBecause the execution of the attack requires only a single, low-cost HTTP request that can be easily scripted and repeated indefinitely, threat actors can maintain a persistent denial of service state against the target environment with minimal effort."
}