CVE-2026-33464

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a specially crafted, oversized payload to an internal Kibana API, causing the Kibana process to exhaust available resources and become unresponsive to all users until the service recovers or is restarted.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-1-security-update-esa-2026-32/386548	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:elastic:kibana::::::::
	cpe:2.3:a:elastic:kibana::::::::
	cpe:2.3:a:elastic:kibana:9.4.0:::::::*

History

14 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Consumo de Recursos No Controlado (CWE-400) en Kibana puede conducir a una denegación de servicio a través de Asignación Excesiva (CAPEC-130). Un usuario autenticado con un rol de bajos privilegios puede enviar una carga útil especialmente diseñada y de tamaño excesivo a una API interna de Kibana, lo que provoca que el proceso de Kibana agote los recursos disponibles y deje de responder a todos los usuarios hasta que el servicio se recupere o se reinicie.

Information

Published : 2026-05-28 20:16

Updated : 2026-10-14 20:10

NVD link : CVE-2026-33464

Mitre link : CVE-2026-33464

CVE.ORG link : CVE-2026-33464

JSON object : View

Products Affected

elastic

kibana

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-33464", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33464", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-29T14:55:07.578374Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@elastic.co", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@elastic.co", "affectedData": [{"vendor": "Elastic", "product": "Kibana", "versions": [{"status": "affected", "version": "9.4.0", "versionType": "semver", "lessThanOrEqual": "9.4.0"}, {"status": "affected", "version": "9.0.0", "versionType": "semver", "lessThanOrEqual": "9.3.4"}, {"status": "affected", "version": "8.0.0", "versionType": "semver", "lessThanOrEqual": "8.19.15"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-28T20:16:23.043", "references": [{"url": "https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-1-security-update-esa-2026-32/386548", "tags": ["Vendor Advisory"], "source": "security@elastic.co"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@elastic.co", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a specially crafted, oversized payload to an internal Kibana API, causing the Kibana process to exhaust available resources and become unresponsive to all users until the service recovers or is restarted."}, {"lang": "es", "value": "Consumo de Recursos No Controlado (CWE-400) en Kibana puede conducir a una denegaci\u00f3n de servicio a trav\u00e9s de Asignaci\u00f3n Excesiva (CAPEC-130). Un usuario autenticado con un rol de bajos privilegios puede enviar una carga \u00fatil especialmente dise\u00f1ada y de tama\u00f1o excesivo a una API interna de Kibana, lo que provoca que el proceso de Kibana agote los recursos disponibles y deje de responder a todos los usuarios hasta que el servicio se recupere o se reinicie."}], "lastModified": "2026-10-14T20:10:00.190", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "43EDC5B3-131D-489E-8447-05C5C599E6A7", "versionEndExcluding": "8.19.16", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E9B40710-912A-4157-9F25-89CE26C098A9", "versionEndExcluding": "9.3.5", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:elastic:kibana:9.4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "66E32573-8928-42AC-8CE5-68F444910F38"}], "operator": "OR"}]}], "sourceIdentifier": "security@elastic.co"}