CVE-2026-63260

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this user-supplied input requires resource-intensive memory allocation that can exhaust the available heap memory in the Kibana process, causing it to crash and become unavailable to all users.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-71/388574	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:elastic:kibana::::::::
	cpe:2.3:a:elastic:kibana::::::::
	cpe:2.3:a:elastic:kibana::::::::

History

24 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Consumo de Recursos Sin Control (CWE-400) en Kibana puede conducir a denegación de servicio a través de Asignación Excesiva (CAPEC-130). Un atacante autenticado con acceso de bajo privilegio puede desencadenar una condición de denegación de servicio en Kibana al enviar una carga útil de solicitud especialmente diseñada y de tamaño excesivo. El procesamiento de esta entrada proporcionada por el usuario requiere una asignación de memoria intensiva en recursos que puede agotar la memoria heap disponible en el proceso de Kibana, provocando que se bloquee y quede no disponible para todos los usuarios.

Information

Published : 2026-07-21 23:18

Updated : 2026-10-24 17:10

NVD link : CVE-2026-63260

Mitre link : CVE-2026-63260

CVE.ORG link : CVE-2026-63260

JSON object : View

Products Affected

elastic

kibana

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-63260", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63260", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T13:08:49.108189Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@elastic.co", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@elastic.co", "affectedData": [{"vendor": "Elastic", "product": "Kibana", "versions": [{"status": "affected", "version": "9.0.0", "versionType": "semver", "lessThanOrEqual": "9.3.7"}, {"status": "affected", "version": "8.0.0", "versionType": "semver", "lessThanOrEqual": "8.19.18"}, {"status": "affected", "version": "9.4.0", "versionType": "semver", "lessThanOrEqual": "9.4.3"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-21T23:18:02.697", "references": [{"url": "https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-71/388574", "tags": ["Vendor Advisory"], "source": "security@elastic.co"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@elastic.co", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this user-supplied input requires resource-intensive memory allocation that can exhaust the available heap memory in the Kibana process, causing it to crash and become unavailable to all users."}, {"lang": "es", "value": "Consumo de Recursos Sin Control (CWE-400) en Kibana puede conducir a denegaci\u00f3n de servicio a trav\u00e9s de Asignaci\u00f3n Excesiva (CAPEC-130). Un atacante autenticado con acceso de bajo privilegio puede desencadenar una condici\u00f3n de denegaci\u00f3n de servicio en Kibana al enviar una carga \u00fatil de solicitud especialmente dise\u00f1ada y de tama\u00f1o excesivo. El procesamiento de esta entrada proporcionada por el usuario requiere una asignaci\u00f3n de memoria intensiva en recursos que puede agotar la memoria heap disponible en el proceso de Kibana, provocando que se bloquee y quede no disponible para todos los usuarios."}], "lastModified": "2026-10-24T17:10:00.220", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F6F4385-627F-4CAE-B0D4-409C92B05866", "versionEndExcluding": "8.19.19", "versionStartIncluding": "8.0.0"}, {"criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DFA9A0A0-0868-43FB-8FBC-F6493C5B2110", "versionEndExcluding": "9.3.8", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE10B417-76BB-4C6D-8D1C-5B029497F013", "versionEndExcluding": "9.4.4", "versionStartIncluding": "9.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@elastic.co"}