Description

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used to assemble the response for each matching document. A single crafted request could therefore make Kibana build a response far larger than the data it was derived from, and the resulting processing and memory pressure exhausts the resources of the Kibana instance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T20:17:28.013Z",
  "pubdate": "2026-08-13T20:17:28.013Z",
  "executiveSummary": "An Allocation of Resources Without Limits or Throttling vulnerability, classified as CWE-770 and CAPEC-130, affects Kibana. The vulnerability exists within the Kibana Playground for RAG feature, specifically in the handling of user-supplied lists of document fields. The absence of length bounding and de-duplication mechanisms allows an attacker to supply a crafted request that forces Kibana to generate a response significantly larger than the underlying data source.\nThe primary impact of this vulnerability is a denial of service (DoS) affecting the availability of the Kibana instance. Excessive memory allocation and heavy processing pressure exhaust critical system resources, potentially causing service crashes or unresponsiveness for all users. The vulnerability can be exploited by any user capable of interacting with the vulnerable endpoint, without requiring elevated privileges.\nThe risk implication is high for environments running vulnerable versions of Kibana, as resource exhaustion can disrupt critical observability and search operations. Mitigation requires restricting input sizes, implementing strict de-duplication, and applying patches or configuration updates provided by the vendor as soon as they become available.",
  "technicalDetails": "The root cause of the vulnerability stems from improper resource allocation and a lack of input validation within the Kibana Playground for RAG feature. Specifically, the application accepts a user-supplied list of document fields without enforcing limits on the maximum length of the list or verifying that the entries are de-duplicated prior to processing.\nThe vulnerable component is the response assembly mechanism for the Kibana Playground for RAG feature. When processing matching documents, the application utilizes the unbounded and non-de-duplicated field list to construct the response payload. Because the input can be artificially inflated with redundant or excessive field parameters, the resulting object expansion causes an exponential increase in memory consumption and CPU utilization.\nThe attack flow begins when an attacker crafts a malicious request containing a specially manipulated list of document fields targeting the Kibana Playground for RAG feature. Upon receipt, the application processes the input without applying boundary checks or filtering out duplicate entries. As Kibana assembles the response for each matching document, the amplification effect triggers excessive allocation. This payload behavior generates massive memory pressure and intensive CPU cycles, ultimately exhausting the available system resources of the underlying Kibana instance and causing a denial of service.\nRegarding execution context, the vulnerability manifests via network exposure through the Kibana interface. While specific authentication and privilege requirements depend on the deployment configuration and accessibility of the Playground for RAG feature, the vector relies on the ability to submit HTTP requests to the vulnerable endpoint."
}