CVE-2026-33465: Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user with low-level permissions could submit a specially crafted request that causes excessive resource consumption, which may render Kibana unavailable.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Kibana deployments are exposed if an authenticated user with low-level permissions can submit requests to the instance. The issue can render Kibana unavailable through excessive resource consumption.
What does an attacker need to exploit it?
The attacker needs valid authentication and low-level Kibana permissions. No user interaction is required, and the vulnerable request can be sent over the network.
What can be done if patching is not immediately possible?
The provided data does not identify a specific workaround. Restricting access for low-privileged users may reduce exposure because exploitation requires an authenticated account with low-level permissions.