Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailable to all users.
Affected Versions:
- 8.x: All versions from 8.0.0 up to and including 8.19.18
- 9.x:
- All versions from 9.0.0 up to and including 9.3.7
- All versions from 9.4.0 up to and including 9.4.3
Users on the 9.5.x release line are not affected. Input validation improvements addressing this vulnerability were included in the 9.5.0 release before its initial publication.
Affected Configurations:
- All Kibana deployments with the machine learning feature enabled and accessible to authenticated users with low-privileged roles.
Solutions and Mitigations:
The issue is resolved in versions 8.19.19, 9.3.8, and 9.4.4.
For Users that Cannot Upgrade:
-
Self-Managed: Setting xpack.ml.enabled to false in kibana.yml will disable the machine learning feature and prevent exploitation of this vulnerability. Note that this will remove all machine learning functionality from Kibana.
-
Cloud: This configuration change is available via the Elasticsearch Service console's custom Kibana configuration. Note that disabling the machine learning feature removes all machine learning functionality.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE ID: CVE-2026-63261
Problem Type: CWE-400 - Uncontrolled Resource Consumption
Impact: CAPEC-130 - Excessive Allocation