CVE-2026-49094
published 2026-05-28CVE-2026-49094: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with…
PriorityP336medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.27%
18.5th percentile
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit a request containing an oversized input value to an analytics collections management endpoint. Kibana will consume excessive CPU and memory resources while processing the request. This results in Kibana becoming unavailable to all users until the service is manually recovered.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | >= 8.0.0 < 8.19.16 | 8.19.16 |
| elastic | kibana | 8.0.0 – 8.19.15 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Elastic Kibana up to 8.19.15 Management Endpoint resource consumption (EUVD-2026-33034)
vuldb·2026-05-28·CVSS 6.5
CVE-2026-49094 [MEDIUM] Elastic Kibana up to 8.19.15 Management Endpoint resource consumption (EUVD-2026-33034)
A vulnerability classified as problematic was found in Elastic Kibana up to 8.19.15. This affects an unknown part of the component Management Endpoint. Executing a manipulation can lead to resource consumption.
This vulnerability is registered as CVE-2026-49094. It is possible to launch the attack remotely. No exploit is available.
GHSA
GHSA-q4c9-4pm6-jq34: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130)
ghsa_unreviewed·2026-05-28
CVE-2026-49094 [MEDIUM] CWE-400 GHSA-q4c9-4pm6-jq34: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130)
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit a request containing an oversized input value to an analytics collections management endpoint. Kibana will consume excessive CPU and memory resources while processing the request. This results in Kibana becoming unavailable to all users until the service is manually recovered.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-28
Published