What is the CVSS score of CVE-2026-63260?

CVE-2026-63260 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Kibana CVE-2026-63260

EUVD-2026-47588 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 security@elastic.co

GHSA-qcp3-347v-7f6g

Elastic Denial Of Service Kibana

6.5

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable web interface, low complexity; PR:L because valid credentials are mandatory; A:H for complete process crash; C:N and I:N as no data exposure or modification occurs.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:58 vuln.today

CVE Published

Jul 21, 2026 - 23:18 cve.org

MEDIUM 6.5

DescriptionCVE.org

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a denial of service condition in Kibana by sending a specially crafted, oversized request payload. Processing this user-supplied input requires resource-intensive memory allocation that can exhaust the available heap memory in the Kibana process, causing it to crash and become unavailable to all users.

AnalysisAI

Denial of service in Elastic Kibana allows any authenticated low-privilege user to crash the Kibana process by sending a specially crafted oversized HTTP request payload, exhausting Node.js heap memory and making the analytics platform unavailable to all users. Affected branches span Kibana 8.x (through 8.19.18), 9.0.x-9.3.x (through 9.3.7), and 9.4.x (through 9.4.3), with patched releases available per ESA-2026-71. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Technical ContextAI

Kibana is Elastic's Node.js-based web frontend for the Elastic Stack, widely used for log analytics, SIEM dashboards, and observability. The root cause is CWE-400 (Uncontrolled Resource Consumption): Kibana fails to enforce bounds on the size of user-supplied request payloads before performing memory allocation proportional to that input. This maps to CAPEC-130 (Excessive Allocation) - the attacker provides a payload large enough to force heap allocations that exhaust the Node.js V8 heap, triggering an out-of-memory crash of the Kibana process. Because Kibana is a single-process service, one successful attack brings down the interface for all concurrent users. Affected CPE covers elastic:kibana versions 8.0.0 through 8.19.18 and 9.0.0 through 9.4.3 as confirmed by EUVD-2026-47588.

RemediationAI

Upgrade to a patched Kibana release: version 8.19.19, 9.3.8, or 9.4.4, per the Elastic security advisory ESA-2026-71 at https://discuss.elastic.co/t/kibana-8-19-19-9-3-8-9-4-4-security-update-esa-2026-71/388574. These fix versions are inferred from the advisory title and EUVD data but have not been independently verified against release artifacts. If immediate patching is not feasible, restrict Kibana access to the minimum necessary set of trusted users, as the PR:L requirement means eliminating untrusted authenticated accounts directly reduces attack surface. Deploying a reverse proxy or API gateway with HTTP request body size limits (e.g., nginx client_max_body_size directive) in front of Kibana can block oversized payloads before they reach the vulnerable process - note this may interfere with legitimate large dashboard imports or bulk operations. Configuring process supervision (systemd with Restart=on-failure or equivalent) reduces sustained downtime from repeated attacks but does not prevent exploitation.