This vulnerability in Elastic Kibana allows an authenticated user with low privileges to submit a specially crafted, oversized payload to an internal API endpoint. The payload triggers excessive resource allocation, exhausting available system resources and causing the Kibana process to become unresponsive. This results in a denial of service condition affecting all users of the service. The vulnerability is tracked as CWE-400 (Uncontrolled Resource Consumption) and is associated with CAPEC-130 (Excessive Allocation). It affects Kibana versions 8.0.0, 9.0.0, and 9.4.0. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, low privileges required, no user interaction, and impact limited to availability.

Successful exploitation results in denial of service by exhausting system resources on the Kibana server, making the service unresponsive to all users until it recovers or is restarted. There is no impact on confidentiality or integrity reported. The attack requires authentication with a low-privileged role, which limits the attacker scope but still allows disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, organizations should monitor Elastic's advisories for updates. Until a patch is available, consider restricting access to Kibana APIs to trusted users and monitoring for unusual payload sizes or resource usage patterns if feasible.