Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service
Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges could supply specially crafted content that expands to a far larger volume of data during processing, exhausting the memory available to Kibana. The Kibana process is terminated by the host and remains unavailable to all users until the service is restarted.
Affected Versions:
- 8.x: All versions from 8.19.0 up to and including 8.19.20
- 9.x:
- All versions from 9.0.0 up to and including 9.4.5
- All versions from 9.5.0 up to and including 9.5.1
Versions prior to 8.19.0 are not affected, because the Streams functionality that contains this vulnerability was not present in those releases.
Affected Configurations:
Kibana deployments in which Streams is enabled and the Streams content packs capability has been turned on. Both are required for the affected functionality to be reachable, and neither is enabled in a default installation. Reaching the affected functionality additionally requires a Kibana account with Streams management privileges.
Solutions and Mitigations:
The issue is resolved in Kibana versions 8.19.21, 9.4.6, and 9.5.2.
For Users that Cannot Upgrade:
Self-Managed and Cloud
- Set the observability:streamsEnableContentPacks advanced setting to off. This removes the ability to import or export Streams content packs.
Indicators of Compromise (IOC)
No specific indicators of compromise have been identified for this vulnerability.
Elastic Cloud Serverless
Due to our continuous deployment and patching model, the vulnerability described in this security advisory was remediated in our Elastic Cloud Serverless offering before the public disclosure.
Severity: CVSSv3.1: Medium ( 6.5 ) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE ID: CVE-2026-72628
Problem Type: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Impact: CAPEC-130 - Excessive Allocation