CVE-2026-49094: Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with viewer-level access can submit a request containing an oversized input value to an analytics collections management endpoint. Kibana will consume excessive CPU and memory resources while processing the request. This results in Kibana becoming unavailable to all users until the service is manually recovered.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49094?
The severity of CVE-2026-49094 is medium with a score of 6.5.
How does CVE-2026-49094 affect Kibana?
CVE-2026-49094 can lead to denial of service due to uncontrolled resource consumption.
What type of access is required to exploit CVE-2026-49094?
Exploitation of CVE-2026-49094 requires authenticated user access with viewer-level permissions.
How can organizations mitigate CVE-2026-49094?
Organizations can mitigate CVE-2026-49094 by limiting the size of input values for requests to the analytics collections management endpoint.
What is the potential impact of CVE-2026-49094?
The potential impact of CVE-2026-49094 is that it can cause a denial of service that hinders the availability of Kibana.