CVE-2026-63261
published 2026-07-21CVE-2026-63261: Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user…
PriorityP336medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.47%
39.8th percentile
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailable to all users.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| elastic | kibana | >= 8.0.0 < 8.19.19 | 8.19.19 |
| elastic | kibana | 8.0.0 – 8.19.18 | — |
| elastic | kibana | >= 9.0.0 < 9.3.8 | 9.3.8 |
| elastic | kibana | 9.0.0 – 9.3.7 | — |
| elastic | kibana | >= 9.4.0 < 9.4.4 | 9.4.4 |
| elastic | kibana | 9.4.0 – 9.4.3 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-63261 awstats: AWStats: Arbitrary code execution via command injection vulnerability [fedora-42]
bugzilla·2026-03-23·CVSS 7.8
CVE-2025-63261 [HIGH] CVE-2025-63261 awstats: AWStats: Arbitrary code execution via command injection vulnerability [fedora-42]
CVE-2025-63261 awstats: AWStats: Arbitrary code execution via command injection vulnerability [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-29b65f46e8 (awstats-8.0-1.fc42) has been submitted as an update to Fedora 42.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-29b65f46e8
Bugzilla
CVE-2025-63261 awstats: AWStats: Arbitrary code execution via command injection vulnerability [fedora-43]
bugzilla·2026-03-23·CVSS 7.8
CVE-2025-63261 [HIGH] CVE-2025-63261 awstats: AWStats: Arbitrary code execution via command injection vulnerability [fedora-43]
CVE-2025-63261 awstats: AWStats: Arbitrary code execution via command injection vulnerability [fedora-43]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
FEDORA-2026-fad30cb6e2 (awstats-8.0-2.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-fad30cb6e2
2026-07-21
Published