Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service
Description:
Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization is evaluated with a worst-case cost that grows disproportionately with the size of the input. Because the evaluation runs synchronously, a single request consumes the Kibana request-processing thread indefinitely, and Kibana stops responding to all further requests until the service is restarted.
Affected Versions:
- All versions from 8.0.0 up to and including 8.19.19
- All versions from 9.0.0 up to and including 9.4.4
Affected Configurations:
All configurations are affected
Solutions and Mitigations:
The issue is resolved in versions 8.19.20 and 9.4.5.
For Users that Cannot Upgrade:
Self-Managed
Disable the TSVB visualization type by adding the following setting to kibana.yml and restarting Kibana:
visTypeTimeseries.enabled: false
Note that this removes the ability to create, edit, or render existing TSVB visualizations, including TSVB panels embedded in dashboards.
Cloud
For Elastic Cloud Hosted deployments, apply the same setting through the Kibana user settings override in the deployment edit view, then save to roll out the change.
visTypeTimeseries.enabled: false
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure. In Elastic Cloud Serverless the affected visualization type is read-only and cannot be created or edited.
Severity: CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE ID: CVE-2026-72663
Problem Type: CWE-407 - Inefficient Algorithmic Complexity
Impact: CAPEC-153 - Input Data Manipulation