This vulnerability in Elastic Kibana allows a low-privileged authenticated user to trigger uncontrolled resource consumption via the machine learning feature. By sending a specially crafted request, the attacker can cause excessive memory allocation, leading to denial of service by making the Kibana server unavailable to all users. The CVSS v3.1 base score is 6.5, reflecting a network attack vector with low complexity and no user interaction required, but requiring privileges. No official fix or patch has been confirmed as of the published date.

Successful exploitation results in denial of service due to memory exhaustion on the Kibana server, impacting availability. Confidentiality and integrity are not affected. The attack requires low-privileged authenticated access, which limits the attacker scope but still poses a significant availability risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to Kibana's machine learning features to trusted users only and monitor for unusual memory usage patterns. No official fix or temporary workaround is currently documented.