Kibana CVE-2026-49087 Vulnerability Advisory: Allocation of Resources Without Limits Leading to DoS

Vulnerability Overview Vulnerability Name: Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service (CVE-770) Vulnerability Description: In Kibana, the lack of limits or throttling on resource allocation can lead to a denial of service (CAPEC-130). An authenticated user can submit a crafted bulk delete request, causing excessive resource consumption and rendering Kibana unavailable. Affected Scope Affected Versions: - 8.x: All versions from 8.0.0 to 8.19.14 - 9.x: All versions from 9.0.0 to 9.3.3 - Versions 9.4.0 and later are not affected Affected Configurations: - Deployments using the Timeline feature. Exploitation requires an authenticated account with Timeline access permissions. Remediation Solution: - This issue has been resolved in versions 8.19.15 and 9.3.4. Users Unable to Upgrade: - There are currently no workarounds for this vulnerability. Additional Information Severity: CVSSv3.1: Medium (6.5) CVSS Score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE ID: CVE-2026-49087 Vulnerability Type: CWE-770 - Allocation of Resources Without Limits or Throttling Impact: CAPEC-130 - Excessive Allocation Related Topics Other related security updates include: - Kibana 8.19.16, 9.3.5, 9.4.1 Security Update (ESA-2026-32) - Kibana 8.19.10, 9.1.10, 9.2.4 Security Update (ESA-2026-03) - Kibana 8.19.16, and 9.3.5 Security Update (ESA-2026-36) - Kibana 8.19.16 Security Update (ESA-2026-39) - Kibana 8.19.10, 9.1.10, 9.2.4 Security Update (ESA-2026-04) Footer Information The footer contains the Elasticsearch copyright notice and relevant trademark information.

Goal Reached Thanks to every supporter — we hit 100%!

Kibana CVE-2026-49087 Vulnerability Advisory: Allocation of Resources Without Limits Leading to DoS