What is the CVSS score of CVE-2026-63139?

CVE-2026-63139 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Kibana CVE-2026-63139

EUVD-2026-46411 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 elastic

GHSA-hxrh-j3c9-q5w4

Denial Of Service Elastic Kibana

6.5

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Kibana is network-accessible, any valid account suffices (PR:L), no complexity or interaction needed; impact is availability-only DoS with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 21:14 vuln.today

CVE Published

Jul 21, 2026 - 20:35 cve.org

MEDIUM 6.5

DescriptionCVE.org

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can exploit an uncontrolled resource consumption vulnerability in Kibana's Canvas functionality by sending a specially crafted request, causing the Kibana server process to terminate and resulting in a denial of service for all users of the affected Kibana instance.

AnalysisAI

Kibana's Canvas functionality allows any authenticated low-privileged user to crash the Kibana server process via a specially crafted request, causing a complete denial of service for all users of the affected instance. The root cause is uncontrolled resource consumption (CWE-400 / CAPEC-130), where Canvas fails to bound server-side resource allocation when processing attacker-controlled input. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the low attack complexity once authenticated makes independent rediscovery plausible.

Technical ContextAI

Kibana is the Node.js-based visualization and analytics frontend of the Elastic Stack, broadly deployed in enterprise SIEM, observability, and log analysis pipelines. Canvas is a Kibana application for building custom data-driven presentations. The vulnerability maps to CWE-400 (Uncontrolled Resource Consumption) via CAPEC-130 (Excessive Allocation), meaning the Canvas request handler does not enforce adequate limits on memory or CPU allocation when processing attacker-supplied input, causing the Node.js process to exhaust resources and terminate abnormally. The affected CPE is cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*, spanning a wide version range in the 8.x and 9.x branches prior to the patched releases.

RemediationAI

Upgrade Kibana to version 8.19.19 (for 8.x deployments), 9.3.8 (for 9.3.x deployments), or 9.4.4 (for 9.4.x deployments) per the vendor security advisory ESA-2026-63 at https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-63/388560. If immediate patching is operationally infeasible, restrict access to the Canvas feature via Kibana's role-based access control by removing the Canvas privilege from all roles except those that explicitly require it - this eliminates the attack surface for users who retain Kibana access but do not need Canvas. Additionally, placing Kibana behind a reverse proxy or VPN and limiting access to known, trusted user populations reduces the attacker pool. Note that restricting Canvas access will break Canvas-based dashboards and presentations for affected users until the patch is applied.