CVE-2026-63260CWE-400denial-of-service

CVE-2026-63260

Medium · published July 22, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
39.8
In the wild
Unconfirmed
What it is

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this user-supplied input requires resource-intensive memory allocation that can exhaust the available heap memory in the Kibana process, causing it to crash and become unavailable to all users.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00472 · 39.8th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-07-22T03:18Z
Affected products (3)
ProductVersionsFixed in
elastic/kibana≥ 8.0.0, < 8.19.198.19.19
elastic/kibana≥ 9.0.0, < 9.3.89.3.8
elastic/kibana≥ 9.4.0, < 9.4.49.4.4
References (1)
https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-71/388574 · [email protected]
EPSS history
Timeline
  • 21 JUL 22:53Z
    Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
    cvelistv5