What is the CVSS score of CVE-2026-42400?

CVE-2026-42400 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Kibana CVE-2026-42400

EUVD-2026-33030 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-05-28 elastic

GHSA-mhgf-jqhm-p7p3

Elastic Denial Of Service

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 21:32 vuln.today

DescriptionCVE.org

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user can send a specially crafted compressed request payload that is processed prior to authorization checks, causing excessive memory and CPU resource consumption that can result in a Kibana instance becoming unresponsive or crashing.

AnalysisAI

Denial of service in Kibana allows any authenticated user to crash or render unresponsive a Kibana instance by sending a specially crafted compressed HTTP request payload. The root cause is an architectural ordering flaw: compressed payloads are decompressed and processed before authorization checks are applied, enabling resource exhaustion (CWE-400, CAPEC-130 Excessive Allocation) at minimal privilege cost. No public exploit identified at time of analysis and no CISA KEV listing, but the low attack complexity and broad authentication base (any valid Kibana login) make this a meaningful availability risk for multi-tenant or internet-exposed deployments.

Technical ContextAI

Kibana (cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*) is Elastic's browser-based analytics and visualization frontend for Elasticsearch. The vulnerability stems from CWE-400 (Uncontrolled Resource Consumption) triggered via CAPEC-130 (Excessive Allocation), a pattern commonly associated with decompression bomb attacks. HTTP request processing pipelines typically decompress encoded payloads (e.g., gzip, deflate, brotli) early in the middleware stack - before routing and authorization - to allow request bodies to be read by downstream handlers. In this case, a malicious compressed payload with a high compression ratio can expand to a size that exhausts heap memory or saturates CPU during decompression, all before Kibana's authorization layer has had the opportunity to validate the requester's permissions for the targeted endpoint. This ordering flaw means that even endpoints requiring elevated privileges are vulnerable to resource exhaustion from low-privileged authenticated users.

RemediationAI

Upgrade Kibana to a fixed release: version 8.19.16, 9.3.5, or 9.4.2, as detailed in Elastic security advisory ESA-2026-35 at https://discuss.elastic.co/t/kibana-8-19-16-9-3-5-9-4-2-security-update-esa-2026-35/386554. If immediate patching is not feasible, the following compensating controls can reduce exposure: restrict Kibana access to the minimum necessary set of authenticated users by tightening role assignments and disabling self-service account creation, which limits the pool of potential attackers; place Kibana behind a reverse proxy or WAF configured to enforce maximum decompressed request body size limits (e.g., nginx client_max_body_size or equivalent), noting that this may reject legitimate large payloads and require tuning; and consider rate-limiting authenticated HTTP requests at the network perimeter to reduce the frequency of potential abuse. Network isolation of Kibana (e.g., not internet-facing) reduces but does not eliminate risk since the vulnerability only requires low-privilege authentication. No workaround fully eliminates the root cause; patching is the definitive fix.