CVE-2026-33464: Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a specially crafted, oversized payload to an internal Kibana API, causing the Kibana process to exhaust available resources and become unresponsive to all users until the service recovers or is restarted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Remove or restrict access to the internal Kibana API for low-privileged/authenticated roles so they cannot submit oversized payloads to internal endpoints.
Kibana internal API access for low-privileged roles = deny - Compensating control
Restrict network access to Kibana and its internal APIs to trusted networks and administrative hosts using firewall rules, VPNs, or network ACLs to prevent untrusted authenticated users from reaching vulnerable endpoints.
- Compensating control
Place a reverse proxy, WAF or API gateway in front of Kibana and configure request size limits and rate limiting to block or throttle oversized payloads and excessive requests before they reach Kibana.
- Operational
If Kibana becomes unresponsive due to resource exhaustion, restart the Kibana service to restore availability and investigate the source of the oversized requests; block offending accounts or IPs as needed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33464?
CVE-2026-33464 has a medium severity rating of 6.5.
How can I fix CVE-2026-33464?
To fix CVE-2026-33464, upgrade to the latest version of Elastic Kibana that addresses this vulnerability.
What causes CVE-2026-33464?
CVE-2026-33464 is caused by uncontrolled resource consumption that allows an authenticated user to submit oversized payloads to an internal Kibana API.
What are the potential impacts of CVE-2026-33464?
CVE-2026-33464 can lead to denial of service by exhausting the Kibana process resources.
Who is affected by CVE-2026-33464?
CVE-2026-33464 affects users of Elastic Kibana, particularly those with low-privileged authenticated roles.