CVE-2026-72667 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature...

EUVD-2026-58268

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature...

CVE-2026-72667

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A specially crafted request submitted by an authenticated user with minimal privileges to a validation capability of the Observability log analysis feature...

CVE-2026-72667

Kibana (Observability log analysis) is affected by CVE-2026-72667: an authenticated, low-privilege user can trigger unbounded concurrent work in a validation capability, exhausting Kibana memory and causing DoS. Affected: Kibana 8.0.0–8.19.19 and 9.0.0–9.4.4. Remediation: upgrade to 8.19.20 or 9....

CVE-2026-72674

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used t...

CVE-2026-72674 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. A user-supplied list of document fields accepted by the Kibana Playground for RAG feature was neither bounded in length nor de-duplicated before it was used t...

CVE-2026-72674

Kibana is affected by CVE-2026-72674 through an unbounded, non‑deduplicated user-supplied list of fields used by the RAG playground, causing excessive resource use and potential denial of service. The root cause is allocation of resources without limits or throttling (CWE-770) during response ass...

CVE-2026-49089

CVE-2026-49089 reflects an issue in Kibana where a query expression accepted by a connector could be processed without size limits, allowing an authenticated read-only user to trigger a DoS by an oversized expression. The Elastic advisories describe the root cause as unbounded evaluation time for...

CVE-2026-49089 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana proces...

CVE-2026-49089

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana proces...

CVE-2026-49089 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana proces...

EUVD-2026-58244

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was processed without any limit on its size, and an oversized expression caused the Kibana proces...

CVE-2026-14456

Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the serve...

DEBIAN-CVE-2026-14456

Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the serve...

CVE-2026-14456

Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the serve...

UBUNTU-CVE-2026-14456

Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the serve...

CVE-2026-14456 Unbounded Memory Growth in QUIC Server Incoming Channel Queue

Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the serve...

CVE-2026-14456 Unbounded Memory Growth in QUIC Server Incoming Channel Queue

Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the serve...

CVE-2026-14456

Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the serve...

EUVD-2026-57919

Issue summary: When an OpenSSL QUIC server Listener SSL object processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the serve...