CVE-2026-49094— Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
Possible ATT&CK Techniques 1AI
T1499 · Endpoint Denial of ServiceGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-49094
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
Source: NVD (National Vulnerability Database)
Vulnerability Description
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit a request containing an oversized input value to an analytics collections management endpoint. Kibana will consume excessive CPU and memory resources while processing the request. This results in Kibana becoming unavailable to all users until the service is manually recovered.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-49094
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-49094
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-49094 (1)
Same Patch Batch · Elastic · 2026-05-28 · 10 CVEs total
| CVE-2026-42398 | 7.7 HIGH | Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access |
| CVE-2026-49095 | 7.2 HIGH | Improper Input Validation in Kibana Fleet Leading to Privilege Escalation |
| CVE-2026-33464 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service |
| CVE-2026-42399 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service |
| CVE-2026-42400 | 6.5 MEDIUM | Uncontrolled Resource Consumption in Kibana Leading to Denial of Service |
| CVE-2026-49093 | 6.3 MEDIUM | Server-Side Request Forgery (SSRF) in Kibana Leading to Unauthorized Network Access |
| CVE-2026-33463 | 5.3 MEDIUM | Operation on a Resource after Expiration or Termination in Kibana Leading to Unauthorized |
| CVE-2026-33462 | 4.6 MEDIUM | Path Traversal in Kibana Leading to Unauthorized Deletion of User Accounts |
| CVE-2026-42401 | 4.1 MEDIUM | Improper Neutralization of Input During Web Page Generation in Kibana Leading to Stored HT |
IV. Related Vulnerabilities
Same product: Kibana
- CVE-2026-49093
Server-Side Request Forgery (SSRF) in Kibana Leading to Unau - CVE-2026-49095
Improper Input Validation in Kibana Fleet Leading to Privile - CVE-2026-42398
Server-Side Request Forgery (SSRF) in Kibana Leading to Unau - CVE-2026-42399
Uncontrolled Resource Consumption in Kibana Leading to Denia - CVE-2026-42400
Uncontrolled Resource Consumption in Kibana Leading to Denia
Same vendor: Elastic
- CVE-2026-49093
Server-Side Request Forgery (SSRF) in Kibana Leading to Unau - CVE-2026-49095
Improper Input Validation in Kibana Fleet Leading to Privile - CVE-2026-42398
Server-Side Request Forgery (SSRF) in Kibana Leading to Unau - CVE-2026-42399
Uncontrolled Resource Consumption in Kibana Leading to Denia - CVE-2026-42400
Uncontrolled Resource Consumption in Kibana Leading to Denia
Same weakness: CWE-400
- CVE-2026-46385
iskorotkov/avro: CPU Exhaustion in Avro Decoder - CVE-2026-45149
brace-expansion: Large numeric range defeats documented `max - CVE-2026-10069
Shibby Tomato miniupnpd resource consumption - CVE-2026-49324
Indian Scout Bobber 2025 WCM brute-force - CVE-2026-42399
Uncontrolled Resource Consumption in Kibana Leading to Denia
V. Comments for CVE-2026-49094
No comments yet