CVE-2026-42400: Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request payload that is processed prior to authorization checks, causing excessive memory and CPU resource consumption that can result in a Kibana instance becoming unresponsive or crashing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the Kibana HTTP endpoints to trusted IP addresses and networks at the firewall or load balancer to reduce exposure to potentially malicious authenticated users.
- Compensating control
Place a reverse proxy or WAF in front of Kibana that blocks or rejects requests with compressed request bodies (e.g., Content-Encoding: gzip/deflate) and enforces strict request body and decompressed payload size limits and request rate limits to prevent excessive memory/CPU consumption.
- Operational
Implement monitoring and alerting for Kibana memory, CPU, and responsiveness. Configure automatic recovery actions (process restart, instance replacement, or scaling) when resource exhaustion or unresponsive behavior is detected, and investigate recent requests causing spikes.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42400?
The severity of CVE-2026-42400 is medium with a score of 6.5.
What is the impact of CVE-2026-42400?
CVE-2026-42400 can lead to denial of service due to uncontrolled resource consumption.
How do I fix CVE-2026-42400?
To fix CVE-2026-42400, you should update your Elastic Kibana to the latest patched version.
Who is affected by CVE-2026-42400?
Authenticated users of Elastic Kibana are potentially affected by CVE-2026-42400.
What type of vulnerability is CVE-2026-42400?
CVE-2026-42400 is classified as an uncontrolled resource consumption vulnerability.