---
id: CVE-2026-42399
title: >-
  Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of
  service via Excessive Allocation (CAPEC-130)
summary: >-
  Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of
  service via Excessive Allocation (CAPEC-130). An authenticated low-privileged
  user can cause Kibana to consume exponentially increasing amounts of memory by
  subm…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
vendor: elastic
product: kibana
affected:
  - 'kibana >= 8.0.0, < 8.19.16'
  - 'kibana >= 9.0.0, < 9.3.5'
patched:
  - kibana 9.3.5
published: '2026-05-28'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42399'
references:
  - url: >-
      https://discuss.elastic.co/t/kibana-8-19-16-and-9-3-5-security-update-esa-2026-36/386556
    label: security@elastic.co
tags:
  - nvd
epss: 0.00472
epssPercentile: 0.39248
ingestedAt: '2026-10-14T20:53:12.345Z'
---

## Overview

Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated low-privileged user can cause Kibana to consume exponentially increasing amounts of memory by submitting a specially crafted Timelion visualization expression containing deeply chained function calls. The resulting data structure grows without bound, exhausting available memory and causing the Kibana service to crash and become unavailable to all users.

## Affected

- `kibana >= 8.0.0, < 8.19.16`
- `kibana >= 9.0.0, < 9.3.5`

## Remediation

Upgrade past the affected range:

- `kibana 9.3.5`