Kibana 8.19.20, 9.4.5 Security Update (ESA-2026-137)

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A query expression accepted by a connector reporting operation was...

Elasticsearch 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-116)

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Memory Allocation with Excessive Size Value CWE-789 in Elasticsearch can lead to denial of service via Excessive Allocation CAPEC-130. An authenticated user holding only read privileges on a single index can...

PT-2026-71766

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated user with permissions to manage maintenance windows can cause a denial of service by submitting a specially crafted, malformed payload. This leads to excessive resource...

PT-2026-71778

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated user with minimal privileges can cause a denial of service by submitting a specially crafted request to a validation capability of the Observability log analysis feature. This...

PT-2026-71749

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An issue exists where a query expression used in a connector reporting operation is processed without limits on its size. This allows an authenticated user with read-only privileges to send a...

PT-2026-71765

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated user with read-only privileges to the alerting feature can cause a denial of service by submitting a specially crafted, malformed payload. This leads to excessive resource...

PT-2026-71784

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Kibana is subject to a denial of service issue due to the allocation of resources without limits or throttling. In the Kibana Playground for the RAG Retrieval-Augmented Generation feature, a...

PT-2026-71755

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description Uncontrolled Recursion in the wildcard matching helper can lead to a denial of service via Excessive Allocation. The matcher used to resolve wildcard patterns against names is implement...

PT-2026-71768

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An issue in the ES|QL query processing allows an authenticated user to submit a specially crafted query. The evaluation of this query can trigger memory allocation with an excessive siz...

PT-2026-71761

Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An authenticated user with read privileges on a single index can trigger a denial of service by submitting a specially crafted search request. This action causes an excessively large...

CVE-2026-63261 Uncontrolled Resource Consumption in Kibana Leading to Denial of Service

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailabl...

PT-2026-63265

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated attacker with low-privilege access can cause a denial of service by sending a specially crafted, oversized request payload. This triggers uncontrolled resource consumption...

CVE-2026-26931

Memory Allocation with Excessive Size Value CWE-789 in the Prometheus remotewrite HTTP handler in Metricbeat can lead Denial of Service via Excessive Allocation CAPEC-130...

PT-2025-54717

Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation CAPEC-130 causing a persistent denial of service OOM crash via submission of oversized user settings data...