What is the CVSS score of CVE-2026-33459?

CVE-2026-33459 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Elastic CVE-2026-33459

EUVD-2026-20521 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-04-08 elastic

GHSA-p635-f626-pv4p

Elastic Denial Of Service

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 18:16 euvd

EUVD-2026-20521

Analysis Generated

Apr 08, 2026 - 18:16 vuln.today

CVE Published

Apr 08, 2026 - 16:46 nvd

MEDIUM 6.5

DescriptionCVE.org

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with access to the automatic import feature can submit specially crafted requests with excessively large input values. When multiple such requests are sent concurrently, the backend services become unstable, resulting in service disruption and deployment unavailability for all users.

AnalysisAI

Denial of service in Kibana's automatic import feature allows authenticated users to trigger uncontrolled resource consumption by submitting specially crafted requests with excessively large input values. When multiple such requests are sent concurrently, backend services become unstable, resulting in service disruption across all users. CVSS 6.5 (medium severity) reflects the authenticated attack requirement and high availability impact without confidentiality or integrity compromise.

Technical ContextAI

The vulnerability exists in Kibana's automatic import feature, which fails to properly validate and limit resource consumption when processing user-supplied input. The root cause is CWE-400 (Uncontrolled Resource Consumption), where the backend does not enforce adequate bounds checking or rate limiting on input size or concurrent request processing. Kibana (cpe:2.3:a:elastic:kibana) is Elastic's analytics and visualization platform built on the Elastic Stack; the automatic import functionality enables bulk data ingest operations. When multiple oversized requests reach the backend simultaneously, they exhaust system resources (CPU, memory, or connection pools), triggering cascading service degradation. This is a classic CAPEC-130 (Excessive Allocation) attack pattern exploiting a lack of resource quotas or queue depth enforcement.

RemediationAI

Upgrade to Kibana 8.19.14 or later for the 8.x branch, or upgrade to Kibana 9.2.8 or later for the 9.x branch (9.3.x users should upgrade to 9.3.3 or later). Consult the Elastic security advisory at https://discuss.elastic.co/t/kibana-8-19-14-9-2-8-9-3-3-security-update-esa-2026-26/385814 for detailed upgrade guidance and version mapping. As an interim workaround pending patching, restrict access to the automatic import feature via role-based access controls (RBAC), limiting the feature to trusted administrators only, or disable the feature entirely if not required. Additionally, implement network-level or reverse-proxy rate limiting and request size caps on the import endpoint to prevent resource exhaustion from large or concurrent requests.