What is the CVSS score of EUVD-2026-58270?

EUVD-2026-58270 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Kibana EUVD-2026-58270

| CVE-2026-72659 MEDIUM

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-08-13 elastic

GHSA-g48r-38gh-835c

Denial Of Service Elastic Kibana

6.5

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable endpoint, low complexity, requires only a valid low-privileged session; sole impact is high availability loss via process crash.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:09 vuln.today

CVE Published

Aug 13, 2026 - 19:12 cve.org

MEDIUM 6.5

DescriptionCVE.org

Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A specially crafted, malformed payload submitted to a Kibana visualization feature by an authenticated user holding only low-privileged access is not correctly validated before use. Processing the request causes unbounded memory growth in the Kibana process, which is terminated by the host once available memory is exhausted. Kibana then becomes unavailable to all users until the service is restarted.

AnalysisAI

Denial of service in Elastic Kibana allows any authenticated low-privileged user to crash the entire Kibana service for all users by submitting a specially crafted, malformed payload to a visualization feature. The root cause is CWE-770 (resource allocation without throttling): Kibana fails to validate the malformed input before processing, causing unbounded heap growth until the host OS kills the process. No public exploit has been identified at time of analysis, and exploitation requires authenticated access, but the low privilege bar and total service disruption make this a meaningful insider or compromised-credential threat. Patch versions 8.19.20 and 9.4.5 are referenced in the vendor advisory ESA-2026-100.

Technical ContextAI

Kibana is Elastic's browser-based analytics and visualization frontend for the Elasticsearch stack, widely deployed for log analysis, SIEM dashboards, and observability. The vulnerability is rooted in CWE-770 (Allocation of Resources Without Limits or Throttling), classified under CAPEC-130 (Excessive Allocation). A visualization feature within Kibana accepts user-supplied payloads but lacks adequate input validation or resource guards - specifically, it does not enforce size limits, schema constraints, or memory consumption caps before processing the request. When a malformed payload is submitted, the Node.js-based Kibana process enters an unbounded memory allocation loop. Once physical and virtual memory is exhausted, the host operating system terminates the process via OOM (out-of-memory) killer. The affected CPE is cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*, indicating broad version coverage prior to the fix.

RemediationAI

Upgrade Kibana to version 8.19.20 (for 8.x deployments) or 9.4.5 (for 9.x deployments), as referenced in Elastic Security Advisory ESA-2026-100 at https://discuss.elastic.co/t/kibana-8-19-20-9-4-5-security-update-esa-2026-100/389519. Patch version numbers are inferred from the advisory URL slug rather than a formal release note, so verify the exact patched release against the Elastic release notes before deploying. If immediate patching is not feasible, restrict Kibana access to trusted, well-monitored user accounts only - remove low-privileged access for users who do not operationally need it, reducing the pool of accounts that could be used to trigger this flaw. Additionally, consider placing Kibana behind a reverse proxy or WAF configured to enforce maximum request body size limits on visualization API endpoints, which may reduce the risk of unbounded payload submission, though this is a compensating control and not a substitute for patching. Monitor the Kibana process for anomalous memory growth and configure process supervisors (systemd, Docker restart policies) to automatically restart Kibana after OOM termination to reduce downtime duration.