CVE-2026-33464: Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a specially crafted, oversized payload to an internal Kibana API, causing the Kibana process to exhaust available resources and become unresponsive to all users until the service recovers or is restarted.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33464?
CVE-2026-33464 has a medium severity rating of 6.5.
How can I fix CVE-2026-33464?
To fix CVE-2026-33464, upgrade to the latest version of Elastic Kibana that addresses this vulnerability.
What causes CVE-2026-33464?
CVE-2026-33464 is caused by uncontrolled resource consumption that allows an authenticated user to submit oversized payloads to an internal Kibana API.
What are the potential impacts of CVE-2026-33464?
CVE-2026-33464 can lead to denial of service by exhausting the Kibana process resources.
Who is affected by CVE-2026-33464?
CVE-2026-33464 affects users of Elastic Kibana, particularly those with low-privileged authenticated roles.