CVE-2026-63260: Uncontrolled Resource Consumption in Kibana Leading to Denial of Service
Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this user-supplied input requires resource-intensive memory allocation that can exhaust the available heap memory in the Kibana process, causing it to crash and become unavailable to all users.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63260?
CVE-2026-63260 has a medium severity rating of 6.5.
How do I fix CVE-2026-63260?
To fix CVE-2026-63260, update to the latest version of Kibana that addresses this vulnerability.
What are the potential impacts of CVE-2026-63260?
CVE-2026-63260 can lead to a denial of service condition due to uncontrolled resource consumption.
Who is affected by CVE-2026-63260?
Authenticated users with low-privilege access to Kibana are affected by CVE-2026-63260.
What type of attacks can exploit CVE-2026-63260?
CVE-2026-63260 can be exploited by sending a specially crafted, oversized request payload to trigger a denial of service.