This vulnerability (CVE-2026-42399) in Elastic Kibana arises from uncontrolled resource consumption (CWE-400) triggered by a malicious Timelion visualization expression. An authenticated low-privileged user can craft deeply chained function calls that cause Kibana to allocate memory exponentially, creating a data structure that grows without bound. This excessive memory allocation leads to a denial of service by crashing the Kibana service and making it unavailable to all users. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and impact limited to availability. The vulnerability affects Kibana versions 8.0.0 and 9.0.0. No patch or official remediation level has been published, and no known exploits are reported in the wild.

Successful exploitation results in denial of service by crashing the Kibana service due to memory exhaustion. This disrupts availability for all users relying on the affected Kibana instance. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict or closely monitor authenticated user access to Timelion visualization features to prevent submission of deeply chained function calls. Consider implementing resource usage limits or timeouts if possible to mitigate excessive memory consumption.