CVE-2026-49087: Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted bulk deletion request that causes excessive resource consumption, which may render Kibana unavailable.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49087?
The severity of CVE-2026-49087 is rated as medium with a score of 6.5.
How does CVE-2026-49087 impact Kibana?
CVE-2026-49087 allows an authenticated user to submit a bulk deletion request that can lead to denial of service by causing excessive resource consumption.
What are the potential consequences of CVE-2026-49087?
The primary consequence of CVE-2026-49087 is that it can render Kibana unavailable due to excessive allocation of resources.
Who is affected by CVE-2026-49087?
CVE-2026-49087 affects Kibana installations where authenticated users have the ability to submit deletion requests.
How can organizations mitigate the risk of CVE-2026-49087?
Organizations should implement rate limiting and request throttling in their Kibana configurations to mitigate the risk of CVE-2026-49087.