This vulnerability in Elastic Kibana allows an authenticated user with access to the automatic import feature to cause uncontrolled resource consumption by submitting specially crafted requests containing excessively large input values. When multiple such requests are processed concurrently, the backend services become unstable, leading to denial of service conditions. The issue is tracked as CWE-400 and has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily on availability. Affected versions include 8.15.0, 9.0.0, and 9.3.0. No official patch or remediation guidance has been published by Elastic as of the vulnerability disclosure date.

The impact of this vulnerability is denial of service due to excessive resource consumption in the Kibana backend services. This results in service disruption and unavailability of the Kibana deployment for all users. There is no impact on confidentiality or integrity reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit access to the automatic import feature to trusted users only and monitor for unusual activity involving large import requests. Consider implementing rate limiting or resource usage controls if possible to reduce the risk of exploitation.