CVE-2026-72628: Improper Handling of Highly Compressed Data in Kibana Leading to Denial of Service
Improper Handling of Highly Compressed Data (CWE-409) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding Streams management privileges could supply specially crafted content that expands to a far larger volume of data during processing, exhausting the memory available to Kibana. The Kibana process is terminated by the host and remains unavailable to all users until the service is restarted.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with Streams management privileges can exploit it by supplying specially crafted highly compressed content. Unauthenticated users and users without those privileges are not identified as able to trigger the issue.
What is the operational impact if exploitation succeeds?
The crafted content can expand during processing and exhaust Kibana's available memory. The host terminates the Kibana process, leaving Kibana unavailable to all users until the service is restarted.
What can be done if patching cannot be performed immediately?
Restrict Streams management privileges to trusted users, since those privileges are required to supply the malicious content. Monitor Kibana availability and be prepared to restart the service if the process is terminated.