CVE-2026-33459: Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submit specially crafted requests with excessively large input values. When multiple such requests are sent concurrently, the backend services become unstable, resulting in service disruption and deployment unavailability for all users.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33459?
CVE-2026-33459 is classified as a critical vulnerability due to its ability to lead to denial of service.
How do I fix CVE-2026-33459?
To fix CVE-2026-33459, users should update Kibana to the recommended secure versions as specified in the official documentation.
Who is affected by CVE-2026-33459?
CVE-2026-33459 affects authenticated users of Elastic Kibana versions between 8.15.0 to 8.19.14, 9.0.0 to 9.2.8, and 9.3.0 to 9.3.3.
What causes CVE-2026-33459?
CVE-2026-33459 is caused by uncontrolled resource consumption due to excessive allocation from specially crafted requests.
What impact does CVE-2026-33459 have on Kibana?
The impact of CVE-2026-33459 is a denial of service, which can disrupt the availability of Kibana services.