This vulnerability in Elastic Kibana allows an authenticated user with low privileges to trigger uncontrolled resource consumption by submitting a specially crafted, oversized payload to an internal API. This results in excessive allocation of resources, causing the Kibana process to become unresponsive and effectively causing a denial of service. The issue is classified under CWE-400 and corresponds to CAPEC-130 (Excessive Allocation). It affects Kibana versions 8.0.0, 9.0.0, and 9.4.0. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, no confidentiality or integrity impact, but high impact on availability.

Successful exploitation leads to denial of service by exhausting Kibana server resources, making the service unresponsive to all users until recovery or restart. There is no impact on confidentiality or integrity reported. The attacker must be authenticated with low privileges, limiting the attack surface to authorized users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is documented, organizations should monitor Elastic's advisories for updates. In the meantime, consider restricting or monitoring access to Kibana APIs for low-privileged users and limit the size of payloads accepted by internal APIs if possible.