CVE-2026-63261 - Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Back Back to CVE browser

MEDIUM

Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Published Jul 21, 2026

6.5

MEDIUM

CVSS 3.1

EPSS 0.47%

Description

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailable to all users.

Affected products

Vendor Elastic Product Kibana Default
unaffected
Affected
- ≥ 8.0.0, ≤ 8.19.18
- ≥ 9.0.0, ≤ 9.3.7
- ≥ 9.4.0, ≤ 9.4.3

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Elastic	Kibana	unaffected	Affected ≥ 8.0.0, ≤ 8.19.18 ≥ 9.0.0, ≤ 9.3.7 ≥ 9.4.0, ≤ 9.4.3

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-400

Uncontrolled Resource Consumption

References (2)

https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-72/388575
Vendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-47589
Advisory

Link	Providers	Tags
https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-72/388575		Vendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-47589		Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner elastic

Published Jul 21, 2026

Updated Jul 22, 2026

Reserved Jul 16, 2026

Link CVE-2026-63261

CISA Vulnrichment

Updated Jul 22, 2026

NVD

Status Analyzed

Modified Aug 3, 2026

Link CVE-2026-63261

Red Hat

No data

ENISA EUVD

Assigner elastic

Published Jul 21, 2026

Updated Jul 22, 2026

Link EUVD-2026-47589

GitHub

No data