Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130).

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 28, 2026 · NIST NVD

   Detected

   Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request payload that is processed prior to authorization checks, causing excessive memory and CPU resource consumption that can result in a Kibana instance becoming unresponsive or crashing.

2. Oct 14, 2026 · NIST NVD

   Updated

   Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request payload that is processed prior to authorization checks, causing excessive memory and CPU resource consumption that can result in a Kibana instance becoming unresponsive or crashing.

Affected

• cpe elastic/kibanaversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2026-42400

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2026-42400

  30-day exploitation probability 0.5%

  first.org
• NIST NVDVulnerability recordCVE-2026-42400

  Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request payload that is processed prior to authorization checks, causing excessive memory and CP

  nvd.nist.gov

References

• Vendor Advisory · discuss.elastic.co