CVE-2026-72663: Inefficient Algorithmic Complexity in Kibana Leading to Denial of Service
Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization is evaluated with a worst-case cost that grows disproportionately with the size of the input. Because the evaluation runs synchronously, a single request consumes the Kibana request-processing thread indefinitely, and Kibana stops responding to all further requests until the service is restarted.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72663?
The severity of CVE-2026-72663 is rated as medium with a CVSS score of 6.5.
How do I fix CVE-2026-72663?
To fix CVE-2026-72663, update to the latest version of Elastic Kibana that addresses this vulnerability.
What is the impact of CVE-2026-72663?
CVE-2026-72663 can lead to a denial of service due to inefficient algorithmic complexity in Kibana.
What kind of attack does CVE-2026-72663 prevent?
CVE-2026-72663 prevents denial of service attacks that exploit deeply nested expressions in Kibana.
Is my Kibana instance affected by CVE-2026-72663?
If you are using affected versions of Elastic Kibana, your instance may be vulnerable to CVE-2026-72663.