What is the CVSS score of EUVD-2026-58273?

EUVD-2026-58273 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Kibana EUVD-2026-58273

| CVE-2026-72663 MEDIUM

Inefficient Algorithmic Complexity (CWE-407)

2026-08-13 elastic

GHSA-pw35-6253-9877

Denial Of Service Elastic Kibana

6.5

CVSS 3.1 · Vendor: elastic

Severity by source

Vendor (elastic) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.5 MEDIUM

Network-reachable, low complexity; low-privilege authentication required; synchronous thread exhaustion causes complete availability loss with no data exposure.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (elastic).

CVSS VectorVendor: elastic

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 20:10 vuln.today

CVE Published

Aug 13, 2026 - 19:13 cve.org

MEDIUM 6.5

DescriptionCVE.org

Inefficient Algorithmic Complexity (CWE-407) in Kibana can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted, deeply nested expression submitted to a Kibana TSVB visualization is evaluated with a worst-case cost that grows disproportionately with the size of the input. Because the evaluation runs synchronously, a single request consumes the Kibana request-processing thread indefinitely, and Kibana stops responding to all further requests until the service is restarted.

AnalysisAI

Algorithmic complexity exhaustion in Kibana's TSVB (Time Series Visual Builder) expression evaluator allows any authenticated user to render the entire Kibana instance unresponsive with a single crafted request. The synchronous evaluation of a specially crafted deeply nested expression monopolizes the Kibana request-processing thread indefinitely, blocking all subsequent requests until the service is manually restarted. Patched versions 8.19.20 and 9.4.5 are available per Elastic advisory ESA-2026-104; no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in Kibana's TSVB expression evaluation engine, affecting all versions as indicated by the wildcard CPE cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*. CWE-407 (Inefficient Algorithmic Complexity) describes a root cause where computational cost scales super-linearly with input depth - in this case, expression nesting causes worst-case evaluation cost to grow disproportionately. The evaluator runs synchronously, which in Kibana's Node.js runtime means the event loop is completely blocked: no I/O, no timers, and no other HTTP requests can be processed while the malicious expression is being evaluated. This follows the CAPEC-153 (Input Data Manipulation) attack pattern, analogous to ReDoS or 'Billion Laughs'-style attacks where crafted input exploits evaluation semantics to cause resource exhaustion without brute force.

RemediationAI

The primary fix is to upgrade Kibana to version 8.19.20 or 9.4.5, as detailed in Elastic security advisory ESA-2026-104 at https://discuss.elastic.co/t/kibana-8-19-20-and-9-4-5-security-update-esa-2026-104/389520. If immediate patching is not feasible, restrict access to TSVB visualization authoring by applying Kibana role-based access controls to limit which user accounts can create or edit TSVB panels - this reduces the exposed attack surface to a smaller set of trusted users, though it does not eliminate risk from compromised privileged accounts. Placing Kibana behind a reverse proxy with aggressive per-request timeout enforcement (e.g., proxy_read_timeout in nginx) can truncate long-running requests, though a sufficiently crafted expression may exhaust the thread before the timeout fires at the proxy layer. Configuring automatic process restart policies (systemd Restart=always, or container restart policies in Kubernetes) can significantly reduce mean time to recovery following exploitation. Monitoring for Kibana unresponsiveness with automated alerting is advised as a detection control.