Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130).

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 28, 2026 · NIST NVD

   Detected

   Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a specially crafted, oversized payload to an internal Kibana API, causing the Kibana process to exhaust available resources and become unresponsive to all users until the service recovers or is restarted.

2. Oct 14, 2026 · NIST NVD

   Updated

   Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a specially crafted, oversized payload to an internal Kibana API, causing the Kibana process to exhaust available resources and become unresponsive to all users until the service recovers or is restarted.

Affected

• cpe elastic/kibanaversion unspecified
• cpe elastic/kibana9.4.0

Sources

• CVE.orgVulnerability recordCVE-2026-33464

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-33464

  30-day exploitation probability 0.5%

  first.org
• NIST NVDVulnerability recordCVE-2026-33464

  Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a specially crafted, oversized payload to an internal Kibana API, causing the Kibana process

  nvd.nist.gov

References

• Vendor Advisory · discuss.elastic.co