CVE-2026-72659
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Unbounded resource allocation in Kibana can lead to denial of service. An authenticated user with low privileges can submit a specially crafted malformed payload to a visualization feature, causing uncontrolled memory growth. The Kibana process is terminated once memory is exhausted, and the service becomes unavailable until restart.
Risk Assessment
A single attacker with minimal privileges can crash Kibana, causing disruptions in access to critical data and analytical functions for the entire organization.
Recommendation
Install vendor security patches and restrict access to visualization features. Implement memory usage monitoring and automatic restarts in case of anomalies.
Original NVD description (English source)
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Kibana visualization feature by an authenticated user holding only low-privileged access is not correctly validated before use. Processing the request causes unbounded memory growth in the Kibana process, which is terminated by the host once available memory is exhausted. Kibana then becomes unavailable to all users until the service is restarted.