What is the CVSS score of CVE-2026-33464?

CVE-2026-33464 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Kibana CVE-2026-33464

EUVD-2026-33010 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-05-28 elastic

GHSA-r7m3-v6c2-v4vr

Elastic Denial Of Service

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 20:25 vuln.today

DescriptionCVE.org

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user holding a low-privileged role can submit a specially crafted, oversized payload to an internal Kibana API, causing the Kibana process to exhaust available resources and become unresponsive to all users until the service recovers or is restarted.

AnalysisAI

Denial of service in Kibana allows any authenticated low-privileged user to render the Kibana service unresponsive for all users by submitting an oversized, specially crafted payload to an internal API endpoint. The CVSS vector (AV:N/AC:L/PR:L/UI:N/A:H) confirms straightforward network exploitation requiring only valid low-privileged credentials with no user interaction - a low barrier for any insider or compromised account. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low complexity and authenticated-but-low-privilege condition makes this a realistic risk in shared Kibana deployments.

Technical ContextAI

Kibana is Elastic's web-based data visualization and analytics frontend for Elasticsearch, widely deployed in enterprise SIEM, observability, and log analytics stacks. CWE-400 (Uncontrolled Resource Consumption) combined with CAPEC-130 (Excessive Allocation) indicates the root cause is an internal API endpoint that fails to enforce payload size or resource consumption limits. When an oversized payload is received, the Kibana Node.js process attempts to allocate the resources needed to process it, exhausting available memory or CPU and blocking all concurrent users until the process recovers or is restarted. The CPE string cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:* uses a wildcard version, indicating the vulnerability spans a broad range of Kibana releases. The affected internal API is not publicly named in available data.

RemediationAI

Upgrade Kibana to a patched release per Elastic Security Advisory ESA-2026-32. Based on the advisory URL pattern, patched versions include 8.19.1, 9.3.5, and 9.4.1 - confirm the exact fix version applicable to your branch at https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-1-security-update-esa-2026-32/386548. As a compensating control prior to patching, enforce request body size limits at the reverse proxy or load balancer sitting in front of Kibana (e.g., nginx client_max_body_size or HAProxy maxreq) to prevent oversized payloads from reaching the application layer. Be aware that overly restrictive size limits may interfere with legitimate large dashboard exports or bulk data operations and should be tuned against observed traffic. Additionally, restrict Kibana access to the minimum necessary set of authenticated users and consider network-layer access controls (VPN, IP allowlisting) to reduce the population of users who can reach the internal API.