EUVD-2026-58268

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature...

CVE-2026-72674

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used t...

CVE-2026-72674 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used t...

CVE-2026-72674

Kibana is affected by CVE-2026-72674 through an unbounded, non‑deduplicated user-supplied list of fields used by the RAG playground, causing excessive resource use and potential denial of service. The root cause is allocation of resources without limits or throttling (CWE-770) during response ass...

CVE-2026-49089

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana proces...

CVE-2026-49089

CVE-2026-49089 reflects an issue in Kibana where a query expression accepted by a connector could be processed without size limits, allowing an authenticated read-only user to trigger a DoS by an oversized expression. The Elastic advisories describe the root cause as unbounded evaluation time for...

CVE-2026-49089 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana proces...

EUVD-2026-58244

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana proces...

Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-137)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-116)

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Memory Allocation with Excessive Size Value CWE-789 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user holding only read privileges on a single index can...

PT-2026-71768

Memory Allocation with Excessive Size Value CWE-789 in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation allocates an unbounded amou...

PT-2026-71765

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated user with read-only privileges to the alerting feature can cause a denial of service by submitting a specially crafted, malformed payload. This leads to excessive resource...

PT-2026-71778

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated user with minimal privileges can cause a denial of service by submitting a specially crafted request to a validation capability of the Observability log analysis feature. This...

PT-2026-71784

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Kibana is subject to a denial of service issue due to the allocation of resources without limits or throttling. In the Kibana Playground for the RAG Retrieval-Augmented Generation feature, a...

PT-2026-71749

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An issue exists where a query expression used in a connector reporting operation is processed without limits on its size. This allows an authenticated user with read-only privileges to send a...

PT-2026-71766

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated user with permissions to manage maintenance windows can cause a denial of service by submitting a specially crafted, malformed payload. This leads to excessive resource...

PT-2026-71755

Uncontrolled Recursion CWE-674 in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation CAPEC-130. The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of mat...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @activepieces/piece-apify (0.2.1) +126 more potentially affected by CVE-2026-69192 via ip-address (>=10.0.1, <=10.2.0)

ip-address NPM version =10.0.1, =0.3.1, =0.0.2, =9.9.0-ruixiang.1, =1.1.0-dev-0d04f54.1, =1.78.0-rc.0, =3.3.0, =1.0.0, =0.2.0-beta.4, =0.3.0-beta.1, =1.0.35, =1.0.31, =1.0.119 and more Source cves: CVE-2026-69192 Source advisory: OSV:GHSA-MWP4-54F8-5FHR...

Russh: Post-auth remote panic via pty-req with more than 130 terminal-mode records

Summary A post-authentication denial-of-service panic in russh 0.62.2 commit c4be19f1915c8682f4615c3fd50008512b474491, current default branch main as of 2026-07-22. An authenticated client sends a pty-req channel request carrying more than 130 terminal-mode records. The parser uses a fixed...

CVE-2026-63261 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailabl...