CVE-2026-42399

6.5 Moyenne

Publiée le 28/05/2026 à 23:16 · Modifiée le 14/10/2026 à 22:10 · Analysée par le NVD · Source : security@elastic.co

Description

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentially increasing amounts of memory by submitting a specially crafted Timelion visualization expression containing deeply chained function calls. The resulting data structure grows without bound, exhausting available memory and causing the Kibana service to crash and become unavailable to all users.

Traduire en français

Produits concernés

Elastic Kibana

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	security@elastic.co	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H`

Faiblesses (CWE)

CWE-400

Références

https://discuss.elastic.co/t/kibana-8-19-16-and-9-3-5-security-update-esa-2026-36/386556 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories