This vulnerability in Elastic Kibana allows an authenticated user to cause excessive resource consumption by submitting specially crafted requests with large input values to the automatic import feature. The concurrent submission of these requests can destabilize backend services, resulting in denial of service conditions that affect all users of the deployment. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. The vulnerability does not impact confidentiality or integrity but causes high impact on availability. No official fix or patch has been released yet, and the product is not a cloud service, so remediation depends on vendor updates.

The impact is denial of service due to resource exhaustion on the backend services of Kibana deployments. This results in service disruption and unavailability for all users. There is no impact on data confidentiality or integrity. The vulnerability requires an authenticated user with privileges to access the automatic import feature, limiting the attack surface to authorized users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, organizations should consider restricting access to the automatic import feature to trusted users only and monitor for unusual activity involving large or excessive input values. Avoid allowing multiple concurrent import requests from the same user or session until a vendor fix is released.