CVE-2026-72674: Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service
Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used to assemble the response for each matching document. A single crafted request could therefore make Kibana build a response far larger than the data it was derived from, and the resulting processing and memory pressure exhausts the resources of the Kibana instance.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72674?
The severity of CVE-2026-72674 is classified as medium with a score of 6.5.
What vulnerability does CVE-2026-72674 describe?
CVE-2026-72674 describes an allocation of resources without limits or throttling in Kibana, leading to potential denial of service.
How can CVE-2026-72674 be mitigated?
CVE-2026-72674 can be mitigated by implementing input validation on user-supplied document fields to enforce limits and prevent excessive resource allocation.
What can be the impact of CVE-2026-72674?
The impact of CVE-2026-72674 can result in a denial of service, effectively making Kibana unresponsive due to excessive resource consumption.
Which applications are affected by CVE-2026-72674?
CVE-2026-72674 specifically affects the Kibana application.