# Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-104)

**URL:** <https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-104/389520>\
**Category:** Security Announcements\
**Created:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-104/389520 "2026-08-13T10:48:08Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [August 13, 2026, 10:48am UTC](https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-104/389520/1 "2026-08-13T10:48:08Z")

</div>

**Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service**

**Description:**  
Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization is evaluated with a worst-case cost that grows disproportionately with the size of the input. Because the evaluation runs synchronously, a single request consumes the Kibana request-processing thread indefinitely, and Kibana stops responding to all further requests until the service is restarted.

**Affected Versions:**

> - All versions from 8.0.0 up to and including 8.19.19
> - All versions from 9.0.0 up to and including 9.4.4

**Affected Configurations:**

All configurations are affected

**Solutions and Mitigations:**

The issue is resolved in versions 8.19.20 and 9.4.5.

**For Users that Cannot Upgrade:**

**Self-Managed**  
Disable the TSVB visualization type by adding the following setting to kibana.yml and restarting Kibana:

> 

visTypeTimeseries.enabled: false

Note that this removes the ability to create, edit, or render existing TSVB visualizations, including TSVB panels embedded in dashboards.

**Cloud**  
For Elastic Cloud Hosted deployments, apply the same setting through the Kibana user settings override in the deployment edit view, then save to roll out the change.

visTypeTimeseries.enabled: false

**Indicators of Compromise (IOC)**  
No specific indicators of compromise have been identified for this vulnerability.

**Elastic Cloud Serverless**  
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. In Elastic Cloud Serverless the affected visualization type is read-only and cannot be created or edited.

**Severity:** CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H  
**CVE ID:** CVE-2026-72663  
**Problem Type:** CWE-407 - Inefficient Algorithmic Complexity  
**Impact:** CAPEC-153 - Input Data Manipulation