What is the CVSS score of CVE-2026-42397?

CVE-2026-42397 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Kibana CVE-2026-42397

EUVD-2026-46387 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-07-21 elastic

GHSA-jpjg-2w23-5jgr

Denial Of Service Elastic Kibana

6.5

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable API with low complexity; authenticated access required (PR:L); impact is availability-only with no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 20:41 vuln.today

CVE Published

Jul 21, 2026 - 19:40 cve.org

MEDIUM 6.5

DescriptionCVE.org

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted request to affected Entity Analytics endpoints containing an oversized input value that causes excessive resource consumption, which may render Kibana unavailable.

AnalysisAI

Denial of service in Kibana's Entity Analytics feature allows authenticated users to render the application unavailable by submitting oversized input values to affected API endpoints. The root cause is CWE-770 - absent resource allocation limits on specific Entity Analytics endpoints - enabling a single crafted request to trigger excessive memory or CPU consumption disproportionate to normal operation. No public exploit code has been identified at time of analysis, and the PR:L authentication requirement constrains opportunistic exploitation to credentialed actors.

Technical ContextAI

Kibana is Elastic's web-based visualization and analytics interface for the Elastic Stack, widely deployed in enterprise SIEM and observability pipelines. The Entity Analytics feature performs entity risk scoring and behavioral analytics over host and user data, exposing dedicated REST API endpoints. CWE-770 (Allocation of Resources Without Limits or Throttling) indicates these endpoints lack server-side constraints on input payload size, allowing a single malformed request to exhaust server resources through excessive allocation, consistent with CAPEC-130 (Excessive Allocation). The CPE string cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:* uses a wildcard version range, confirming all Kibana versions prior to the patched releases are in scope.

RemediationAI

Upgrade Kibana to version 9.3.7 or 9.4.4 as appropriate for the deployed branch, per Elastic security advisory ESA-2026-55 at https://discuss.elastic.co/t/kibana-9-3-7-9-4-4-security-update-esa-2026-55/388554/1. If immediate patching is not feasible, disable the Entity Analytics feature entirely if it is not operationally required - this eliminates the vulnerable endpoints at the cost of losing entity risk scoring and behavioral analytics capabilities. Alternatively, restrict access to Entity Analytics API endpoints via a reverse proxy or network policy to limit requests to a narrowly trusted set of service accounts, reducing the pool of potential authenticated abusers. Enforcing request body size limits at the load balancer or API gateway layer is an additional compensating control that can cap payload sizes independent of application-level fixes.