VYPR
← All advisories
Medium severity6.5NVD Advisory· Published May 28, 2026· Updated Jun 1, 2026

CVE-2026-42399

CVE-2026-42399

Description

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentially increasing amounts of memory by submitting a specially crafted Timelion visualization expression containing deeply chained function calls. The resulting data structure grows without bound, exhausting available memory and causing the Kibana service to crash and become unavailable to all users.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5
  • Elastic/Kibanainferred3 versions
    (expand)+ 2 more
    • (no CPE)
    • cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*range: >=8.0.0,<8.19.16
    • (no CPE)range: <8.19.16, <9.3.5
  • osv-coords2 versions
    pkg:bitnami/elkpkg:bitnami/kibana
    >= 8.0.0, < 8.19.16+ 1 more
    • (no CPE)range: >= 8.0.0, < 8.19.16
    • (no CPE)range: >= 8.0.0, < 8.19.16

Patches

Vulnerability mechanics

References

1

News mentions

1